Is a data processing agreement a legal requirement in Scotland?
Yes. The UK GDPR applies in Scotland and, wherever a processor handles personal data for a controller, it demands a written contract that includes the terms listed in Article 28.
Be Wise › Be Contract Wise (Scotland) guides › Data processing agreement
Data processing agreement (Scotland)
Under Article 28 of the UK GDPR, a controller that has a processor handle personal data for it must put the terms of that arrangement in a contract, and a data processing agreement (DPA) does exactly that. It describes the processing and commits the processor to follow instructions only, protect the data, keep sub-processors under control, support the controller on data subject rights and on breaches, and either return or delete the data when the work ends.
When you need one
You need one whenever a supplier, such as a payroll bureau, an IT or cloud provider, a marketing agency or a software provider, deals with personal data for you, and equally when you handle personal data for a client.
What it should contain
Processing details
Subject matter, duration and purpose, plus the categories of data and data subjects.
Instructions
The processor may act only on documented instructions from the controller.
Security
Technical and organisational measures that are appropriate.
Sub-processors
Authorisation, notification, and passing obligations down.
Breaches
Prompt notification to the controller.
End of processing
Deletion or return of the data.
Points specific to Scotland
- UK data protection law applies across the UK, including Scotland; the regulator is the Information Commissioner's Office.
Different rules can apply elsewhere in the UK: see the England and Wales version of this guide.
Common mistakes
- Having nothing in writing, which puts both parties in breach of the UK GDPR.
- Processing details lifted from a template and left vague.
- No international transfer mechanism.
View a specimen data processing agreement. It briefly illustrates the structure and main clauses, set out in the way the app generates them.
Quick answers
Who is the controller and who is the processor in Scotland?
The controller determines the purposes and means of using personal data. The processor deals with that data for the controller, following its instructions.
Draft your data processing agreement now
Be Contract Wise (Scotland)'s powerful, carefully prepared drafting tools turn a short set of plain-English questions into a data processing agreement under Scots law, laid out to a professional standard, with an explanation of every clause. Simple or complex, export to Word or PDF.
Start drafting — freeBrowse all guidesReviewed 2026-09-24. General legal information about Scots law, not legal advice.