Data Processing Agreement (DPA) template

Overview

A data processing agreement (DPA) is the contract required by Article 28 of the UK GDPR (the retained EU GDPR, as it forms part of UK law under the Data Protection Act 2018) whenever a controller instructs a processor to process personal data on its behalf. Article 28(3) sets out an exhaustive list of terms that must be included: the subject matter, duration, nature and purpose of processing; the categories of personal data and data subjects; the controller's and processor's obligations and rights; and specific processor obligations, including processing only on documented instructions, ensuring confidentiality, implementing appropriate technical and organisational security measures, engaging sub-processors only with authorisation and equivalent contractual protections, assisting the controller with data subject rights requests and breach notifications, deleting or returning data at the end of the engagement, and submitting to audits. A UK-specific point that has no equivalent in an EU DPA is international transfers post-Brexit: the UK GDPR and EU GDPR are now separate legal regimes. A transfer of personal data from the UK to a country without a UK adequacy regulation from the Secretary of State requires an appropriate safeguard — most commonly the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, rather than the EU Standard Contractual Clauses alone, which do not by themselves cover a UK-outbound transfer. Where the processor is itself established outside the UK, or subcontracts hosting to a non-UK provider, the transfer mechanism must be checked and documented separately from the EU position. When to use it: whenever any supplier processes personal data on behalf of a customer as part of delivering a service — hosting, SaaS, payroll, marketing platforms, IT support with data access, and so on. It is typically referenced as a schedule to, or executed alongside, the main services agreement. Parties: the controller (the customer, who determines the purposes and means of processing) and the processor (the supplier, who processes data only on the controller's documented instructions). Key clauses: subject matter, duration, nature and purpose of processing; categories of personal data and data subjects; processing on documented instructions only; confidentiality of personnel; security measures (Article 32 UK GDPR); sub-processing authorisation; assistance with data subject rights and Data Protection Impact Assessments; personal data breach notification, without undue delay; end-of-contract deletion or return of data; audit rights; and international transfer safeguards (IDTA / UK Addendum where relevant). Pitfalls to avoid: relying on EU Standard Contractual Clauses alone for a UK-outbound transfer without the UK Addendum, which leaves the transfer without a valid UK safeguard; allowing sub-processors without a documented authorisation and flow-down of equivalent obligations; and omitting a concrete breach notification timeframe, which leaves the controller unable to meet its own 72-hour ICO notification duty under Article 33 UK GDPR.