Is a data processing agreement a legal requirement?
Yes. Where a processor processes personal data for a controller, the UK GDPR requires a written contract containing the terms set out in Article 28.
Be Wise › Be Contract Wise (Scotland) guides › Data processing agreement
Data processing agreement (Scotland)
A data processing agreement (DPA) sets the terms on which a processor handles personal data for a controller, as Article 28 of the UK GDPR requires. It records the details of the processing and binds the processor to act only on instructions, keep the data secure, control sub-processors, help with data subject rights and breaches, and delete or return the data at the end.
When you need one
Use one whenever a supplier — a payroll bureau, IT or cloud provider, marketing agency or software provider — handles personal data on your behalf, or when you do so for a client.
What it should contain
Processing details
Subject matter, duration, purpose, types of data and data subjects.
Instructions
The processor acts only on the controller's documented instructions.
Security
Appropriate technical and organisational measures.
Sub-processors
Authorisation, notice and flow-down of obligations.
Breaches
Prompt notification to the controller.
End of processing
Deletion or return of the data.
Points specific to Scotland
- UK data protection law applies across the UK, including Scotland; the regulator is the Information Commissioner's Office.
Different rules can apply elsewhere in the UK: see the England and Wales version of this guide.
Common mistakes
- No written terms at all, which breaches the UK GDPR for both parties.
- Vague processing details copied from a template.
- No mechanism for international transfers.
See a specimen data processing agreement — a short illustration of the structure and key clauses, laid out as the app produces them.
Quick answers
Who is the controller and who is the processor?
The controller decides why and how personal data is used. The processor handles it on the controller's behalf and on its instructions.
Draft your data processing agreement now
Be Contract Wise (Scotland)'s powerful, carefully prepared drafting tools turn a short set of plain-English questions into a data processing agreement under Scots law, laid out to a professional standard, with an explanation of every clause. Simple or complex, export to Word or PDF.
Start drafting — freeBrowse all guidesReviewed 2026-09-24. General legal information about Scots law, not legal advice.