Data Processing Agreement Solicitors
A data processing agreement (DPA) is a legally required contract between a controller and a processor that sets out how the processor will handle personal data on the controller’s behalf, including the security measures, sub-processing rules and assistance the processor must provide.
call 0207 100 2525 to speak to a specialist today. Available 24/7
Adam Bernard Solicitors drafts and reviews data processing agreements for businesses that outsource services involving personal data and for suppliers who process data for clients.
If another business handles personal data for you, for example payroll, cloud hosting, CRM, marketing or IT support, UK GDPR requires a written contract with specific terms. Without one, both parties are in breach.
Call 0207 100 2525 or book a free consultation — via Zoom, Teams, WhatsApp or Skype
Controller or Processor?
A controller decides why and how personal data is processed; a processor processes it only on the controller’s documented instructions. The distinction drives every data protection contract:
• If your supplier acts only on your instructions, it is a processor and you need a data processing agreement.
• If both organisations decide independently how to use the data, they are separate controllers and a data sharing agreement is more appropriate.
• If they decide jointly, they are joint controllers and must have a transparent arrangement under Article 26.
What Must a Data Processing Agreement Include?
Article 28 of the UK GDPR requires the contract to set out the subject matter, duration, nature and purpose of processing, the types of personal data and data subjects, and the obligations and rights of the controller. The processor must also commit to:
• Processing only on documented instructions.
• Ensuring staff are bound by confidentiality.
• Implementing appropriate security measures under Article 32.
• Engaging sub-processors only with authorisation and on equivalent terms.
• Assisting the controller with data subject rights requests.
• Assisting with security, breach notification and impact assessments.
• Deleting or returning data at the end of the services.
• Making available information needed to demonstrate compliance, and allowing audits.
See Article 28 of the UK GDPR and the ICO’s guidance on what needs to be included in the contract.
Data (Use and Access) Act 2025 Changes
The Data (Use and Access) Act 2025 amended UK GDPR, and most data protection changes came into force on 5 February 2026. The Data (Use and Access) Act 2025 introduced changes including recognised legitimate interests, revised rules on automated decision-making and new provisions on international transfers. From 19 June 2026, controllers must also have a process for handling data protection complaints. Processors should be required to assist with these processes. The government’s commencement plan sets out the timetable.
International Transfers
If the processor or a sub-processor transfers personal data outside the UK, the data processing agreement must address transfer safeguards. Transfers must comply with Chapter V of the UK GDPR, for example by relying on UK adequacy regulations or appropriate safeguards such as the International Data Transfer Agreement.
Commercial Terms Beyond Article 28
A good data processing agreement also deals with commercial risk, not just the statutory minimum. Points to negotiate include:
• Liability caps for data breaches and how they interact with the main contract.
• Indemnities for regulatory fines and third-party claims.
• Breach notification timescales, often within 24 to 48 hours.
• Security standards and certifications.
• Costs of assisting with audits and data subject requests.
• Insurance.
Liability and Enforcement
Both controllers and processors can be fined by the Information Commissioner, and processors can be directly liable for failing to meet their obligations. Fines can reach £17.5 million or 4% of global annual turnover for the most serious breaches under the Data Protection Act 2018 and UK GDPR.
Where the Data Processing Agreement Sits
A data processing agreement is usually a schedule to the main services contract, such as an IT services agreement, SaaS agreement or supply of services agreement. It should be consistent with your data protection policies and your public privacy policy.
Data Processing Agreement Checklist
Before signing or accepting a supplier’s DPA, controllers should confirm:
• The processing details (subject matter, duration, data types, data subjects) are accurate.
• All mandatory Article 28 terms are present.
• Sub-processors are listed and changes require notice and a right to object.
• Breach notification timescales allow you to meet the 72-hour ICO deadline.
• International transfers are identified and safeguarded.
• Liability for data breaches is not capped at an unrealistically low level.
How Adam Bernard Solicitors Can Help
We draft data processing agreements for controllers and processors, review suppliers’ standard DPAs through our contract review service, and update existing DPAs for the Data (Use and Access) Act 2025. See all our commercial contract services.
Call 0207 100 2525 (24/7) or book a free consultation to discuss your contract.
This page is for information only and does not constitute legal advice.
Frequently Asked Questions
Is a data processing agreement a legal requirement?
What is the difference between a controller and a processor?
Do I need a data processing agreement with my cloud software provider?
Did the Data (Use and Access) Act 2025 change data processing agreements?
Can a processor use sub-processors?
Request to book a Free Consultation
Our Clients Share Their Success Stories.
Good service 👍 👌 many thanks for the great service you have provided to us. Our visa got approved just within 2 weeks only because of your hardwork and subject matter expertise. I am very thankful to you
For me, it was the attitude towards the job the lawyers displayed. Totally unmatched. I've been in and out of law firms because of the divorce with my wife and other related issues but Adam Bernard Solicitors was it for me guys. The best!
I want to thank Adam Benard team, they really helped me in my process of purchasing a property, their team are listen and respond to their customers fast. I really love your service, thanks alot.
Adam Bernard team helped me to purchase the best property for the best amount of time for the best money i have . i personally love dealing with them and i thank the team for all the efforts they made to make the task better .
