A full Article 28 controller-to-processor agreement – instructions, security, sub-processors, international transfers, breaches, audits and deletion – with four schedules.
Data protection & GDPR
Data Processing Agreement
About this document
A stand-alone agreement between a controller (the organisation that decides how personal data is used) and a processor (a supplier that handles it on the controller’s behalf). Article 28 of the UK GDPR requires a written contract with specific terms; this agreement contains all of them, plus practical provisions on breach timescales, sub-processors, transfers, audits, liability and the new complaints duty.
The document is laid out in the sections below. Each one comes with a plain-English guidance note explaining what it does and what to change.
Our templates are professionally structured starting points for UK businesses, not legal advice. For anything complex, unusual or high-value, have your final version checked by a solicitor.
Included in the pack
Data protection & GDPR
for every document in this category
Editable Microsoft Word files
Guidance notes in every document
Written for UK businesses
Download and keep
Need more than one category?
Documents All-Access gives you every category for 12 months for £295.
Compare options →Need it tailored?
We can adapt any template to your business, or write a document from scratch.
Talk to us →
