Is a data processing agreement a legal requirement?
Yes. Where a processor processes personal data for a controller, the UK GDPR requires a written contract containing the terms set out in Article 28.
Be Wise › Be Contract Wise guides › Data processing agreement
Data processing agreement (England and Wales)
A data processing agreement (DPA) sets the terms on which a processor handles personal data for a controller, as Article 28 of the UK GDPR requires. It records the details of the processing and binds the processor to act only on instructions, keep the data secure, control sub-processors, help with data subject rights and breaches, and delete or return the data at the end.
When you need one
Use one whenever a supplier — a payroll bureau, IT or cloud provider, marketing agency or software provider — handles personal data on your behalf, or when you do so for a client.
What it should contain
Processing details
Subject matter, duration, purpose, types of data and data subjects.
Instructions
The processor acts only on the controller's documented instructions.
Security
Appropriate technical and organisational measures.
Sub-processors
Authorisation, notice and flow-down of obligations.
Breaches
Prompt notification to the controller.
End of processing
Deletion or return of the data.
Points specific to England and Wales
- Article 28 of the UK GDPR sets the mandatory content. The controller usually has 72 hours to report a notifiable breach to the Information Commissioner, so it needs prompt notice from the processor. Transfers outside the UK need a mechanism such as the International Data Transfer Agreement.
Different rules can apply elsewhere in the UK: see the Scotland version of this guide.
Common mistakes
- No written terms at all, which breaches the UK GDPR for both parties.
- Vague processing details copied from a template.
- No mechanism for international transfers.
See a specimen data processing agreement — a short illustration of the structure and key clauses, laid out as the app produces them.
Quick answers
Who is the controller and who is the processor?
The controller decides why and how personal data is used. The processor handles it on the controller's behalf and on its instructions.
Draft your data processing agreement now
Be Contract Wise's powerful, carefully prepared drafting tools turn a short set of plain-English questions into a data processing agreement under the law of England and Wales, laid out to a professional standard, with an explanation of every clause. Simple or complex, export to Word or PDF.
Start drafting — freeBrowse all guidesReviewed 2026-09-24. General legal information about the law of England and Wales, not legal advice.