data processing agreement template uk

Data Processing Agreement

Instructions for Use

• Complete all bracketed fields to accurately reflect the roles and responsibilities of the Controller and the Processor.
• Ensure the "Description of Processing" in the Annex is completed with specific details regarding the nature, purpose, and duration of the data processing activities.
• Execute this document as an addendum to your primary services agreement and ensure that both parties retain a signed copy for compliance audit purposes.

1. Parties and Definitions

This Data Processing Agreement (the "Agreement") is entered into by and between:

The Controller: [Company Name], a company incorporated in [Jurisdiction] with registered office at [Registered Address] ("Controller").

The Processor: [Company Name], a company incorporated in [Jurisdiction] with registered office at [Registered Address] ("Processor").

"Data Protection Legislation" means the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Processing of Personal Data

2.1 The Processor shall process Personal Data only on documented instructions from the Controller, including with regard to transfers of personal data to a third country or an international organisation. 2.2 The Processor shall ensure that persons authorised to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. 2.3 The Processor shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR.

3. Sub-processing

3.1 The Processor shall not engage another processor without prior specific or general written authorisation of the Controller. 3.2 Where the Processor engages another processor for carrying out specific processing activities on behalf of the Controller, the same data protection obligations as set out in this Agreement shall be imposed on that other processor by way of a contract.

4. Data Subject Rights

4.1 Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organisational measures, insofar as this is possible, for the fulfilment of the Controller's obligation to respond to requests for exercising the data subject's rights.

5. Audit and Compliance

5.1 The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this Agreement and allow for and contribute to audits, including inspections, conducted by the Controller or another auditor mandated by the Controller.

6. Duration and Termination

6.1 This Agreement shall remain in effect for the duration of the provision of services by the Processor to the Controller. Upon termination, the Processor shall, at the choice of the Controller, delete or return all the Personal Data to the Controller.

7. Annex: Description of Processing

• Subject Matter: [__________]
• Nature and Purpose: [__________]
• Duration of Processing: [__________]
• Types of Personal Data: [__________]
• Categories of Data Subjects: [__________]

Signature & Acknowledgment

For and on behalf of the Controller: Signature: __________ Printed Name: [] Title: [] Date: [__________]

For and on behalf of the Processor: Signature: __________ Printed Name: [] Title: [] Date: [__________]

Legal Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. You must consult with qualified legal counsel to ensure this agreement satisfies your specific operational requirements and current UK regulatory compliance standards.