Specimen data processing agreement (England and Wales)

This Data Processing Agreement is made this [  ] day of [insert month] [insert year] between:

(a)[PARTY 1 NAME] LIMITED, a company incorporated in England and Wales with company number [number], whose registered office is at [address] (the “[Short name]”)

(b)[PARTY 2 NAME] LIMITED, a company incorporated in England and Wales with company number [number], whose registered office is at [address] (the “[Short name]”)

together herein referred to as the “Parties” or individually as a Party

(A)The parties have entered into the Main Agreement, under which the Processor processes personal data on behalf of the Controller.

(B)This Agreement sets out the terms required by Article 28 of the UK GDPR.

The Parties agree as follows:

In this Agreement, the following definitions apply:

“Agreement” means this agreement including its Schedule.

“Main Agreement” means the agreement described in the Schedule.

“UK GDPR” has the meaning given in section 3(10) of the Data Protection Act 2018.

The Processor shall:

(a)process the personal data only on the documented instructions of the Controller;

(b)ensure that persons authorised to process the personal data are bound by confidentiality;

(c)implement appropriate technical and organisational measures in accordance with Article 32 of the UK GDPR; and

(d)at the end of the services, delete or return all the personal data, at the Controller's choice.

The Processor shall notify the Controller without undue delay, and in any event within 24 hours, after becoming aware of a personal data breach, with the information the Controller needs to meet its own obligations.

4.1Either party may terminate this Agreement immediately by written notice if the other party commits a material breach which, if capable of remedy, it fails to remedy within 30 days of written notice requiring it to do so.

4.2Termination does not affect any rights or remedies which have accrued as at the date of termination.

Any notice under this Agreement shall be in writing and delivered by hand, by pre-paid first-class post or by email to the address of the recipient set out in this Agreement, or such other address as it notifies.

This Agreement constitutes the entire agreement between the parties and supersedes all previous agreements, promises and understandings between them relating to its subject matter.

No variation of this Agreement shall be effective unless it is in writing and signed by or on behalf of each of the parties.

A person who is not a party to this Agreement shall not have any rights under the Contracts (Rights of Third Parties) Act 1999 to enforce any term of this Agreement.

This Agreement may be executed in any number of counterparts, each of which when executed shall constitute a duplicate original, but all the counterparts shall together constitute the one agreement.

10.1If a dispute arises out of or in connection with this Agreement, the parties shall first attempt to resolve it by negotiation between senior representatives.

10.2If the dispute is not resolved within 30 days, the parties shall attempt to settle it by mediation in accordance with the CEDR Model Mediation Procedure.

10.3If the dispute is not settled by mediation within 60 days of the mediator's appointment, either party may refer it to the courts of England and Wales.

This Agreement shall be governed by and construed in accordance with the laws of England and Wales.

This Agreement has been entered into on the date stated at the beginning of it.

[Details of the data processing agreement: parties' particulars, description, price and timetable.]