Data Processing Agreement — UK GDPR (DPA 2018)

A Data Processing Agreement — UK GDPR (DPA 2018) in the United Kingdom sets out what each party will provide, the consideration involved, and the responsibilities they take on for the arrangement, under the framework of the Data Protection Act 2018.

Following the UK's departure from the European Union, the UK retained the EU GDPR as the foundation of its domestic data protection framework, supplemented by the Data Protection Act 2018 (DPA 2018). The UK GDPR is functionally equivalent to the EU GDPR in most respects but has been adapted for the UK domestic context, including the appointment of the Information Commissioner's Office (ICO) as the principal supervisory authority.

Under the UK GDPR, a Data Controller is the entity that determines the purposes and means of processing personal data — for example, a business that instructs a cloud software provider to store and manage its customer records. The Data Processor is the entity that processes personal data on behalf of the Controller — in this example, the cloud provider. Both the Controller and the Processor have distinct obligations under the UK GDPR, and the DPA is the mechanism through which those obligations are formally established and documented.

Our UK Data Processing Agreement template is drafted in accordance with Article 28 of the UK GDPR and the ICO's guidance on Controller-Processor relationships. It covers all mandatory elements, including the subject matter, nature, and purpose of the processing, the categories of personal data, the duration of processing, the Processor's obligations regarding security measures under Article 32, breach notification within 72 hours to the ICO, assistance with data subject rights, international transfer safeguards, sub-processor management, and audit rights.

The legal framework governing the Data Processing Agreement — UK GDPR (DPA 2018) in United Kingdom draws on several key statutes and regulatory bodies. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Parties executing a Data Processing Agreement — UK GDPR (DPA 2018) in United Kingdom should confirm the document reflects current law, including any amendments enacted since the original drafting date. The Companies Act 2006 sets the foundational requirements.

A Data Processing Agreement is legally required whenever a Data Controller engages a third party to process personal data on its behalf, and that third party processes the data only on the Controller's instructions. This applies across a vast range of common business relationships in the UK.

You need a DPA whenever you use a cloud computing service (such as a CRM, HR system, payroll platform, or email marketing tool) that processes your customers' or employees' personal data. Similarly, if you outsource IT support, customer service, accounting, or any other function that involves access to personal data, the provider of those services is acting as your Data Processor and a DPA is required.

The obligation also applies if you use a recruitment agency or employment business that processes personal data of job applicants on your behalf, if you engage a market research firm to process customer data for analysis, or if you use a third-party payment processor that handles personal financial information of your customers.

The consequences of failing to have a compliant DPA are significant. The ICO has the power to impose fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for serious infringements of the UK GDPR, including the failure to put appropriate contracts in place with processors. Beyond regulatory fines, the absence of a DPA exposes businesses to reputational damage, loss of customer trust, and civil claims from data subjects whose rights have been infringed.

Even where a DPA is not strictly required by law — for example, where both parties are joint controllers rather than a controller-processor relationship — it remains best practice to document the data sharing arrangement in writing to demonstrate accountability under Article 5(2) of the UK GDPR.

Parties in United Kingdom should prepare a Data Processing Agreement — UK GDPR (DPA 2018) proactively rather than waiting for a dispute to arise. Courts interpret agreements based on the written terms rather than oral representations. Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Where the transaction involves regulated activities, prior approval from the relevant authority may be required before execution.

A compliant Data Processing Agreement for UK businesses must contain several mandatory elements as prescribed by Article 28(3) of the UK GDPR, supplemented by the ICO's guidance on processor contracts.

The parties section must clearly identify the Data Controller and Data Processor by their full legal names and registered addresses. Where the controller is providing instructions to the processor, the agreement must make clear that the processor acts only on documented instructions from the controller.

The processing details section is the operational core of the agreement. It must specify: the subject matter and duration of the processing; the nature and purpose of the processing; the type of personal data being processed; and the categories of data subjects affected. This information must be sufficiently detailed to demonstrate that the processing is limited to what is necessary for the specified purpose — reflecting the data minimisation principle under Article 5(1)(c) of the UK GDPR.

The processor obligations section must cover all the mandatory requirements of Article 28(3), including: the confidentiality obligation (confirming that all authorised persons are bound by appropriate confidentiality undertakings); security measures under Article 32 (specifying the technical and organisational measures implemented by the processor); sub-processor management (requiring prior written consent before engaging sub-processors and imposing equivalent obligations on sub-processors); assistance with data subject rights; assistance with the controller's Article 32–36 obligations; deletion or return of personal data on termination; and audit rights.

The breach notification provisions are of particular importance. Under Article 33, the Controller must notify the ICO within 72 hours of becoming aware of a breach. The DPA should require the Processor to notify the Controller within 24 hours to give the Controller adequate time to comply. The notification should include a description of the breach, the categories and approximate number of affected data subjects and records, contact details of the processor's data protection point of contact, likely consequences, and measures taken or proposed.

The international transfers section addresses restrictions on transferring personal data outside the United Kingdom. Unless the destination country benefits from a UK adequacy decision, appropriate safeguards must be in place, such as the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses.

Finally, the governing law clause should specify the laws of England and Wales as the governing law and designate the courts of England and Wales as having exclusive jurisdiction, confirming that any disputes are resolved in a forum familiar with UK data protection law.

Additional compliance elements for a Data Processing Agreement — UK GDPR (DPA 2018) used in United Kingdom include: Under the Companies Act 2006, Companies House maintains the register of UK companies. Section 386 of the Companies Act 2006 sets accounting record obligations. The Competition and Markets Authority (CMA) enforces the Consumer Rights Act 2015. The Financial Conduct Authority (FCA) regulates financial services under the Financial Services and Markets Act 2000. The High Court of Justice has jurisdiction under the Senior Courts Act 1981. Forms-legal.com provides this template as a starting point for United Kingdom-compliant documentation.