Data Processing Agreement Template
A data processing agreement (DPA) is required under UK GDPR whenever one party processes personal data on another's behalf. It sets out the obligations that protect that data.
What this data processing agreement covers
- Scope and purpose of processing
- Security measures
- Sub-processing rules
- Data subject rights support
- Breach notification and audit
When you need a data processing agreement
- Using a processor for personal data
- Offering services that process client data
- Meeting UK GDPR Article 28 requirements
The legal framework
Understanding the law behind a data processing agreement helps you use it well. Here is the key UK legislation that applies:
Frequently asked questions
When is a DPA legally required?
Whenever a processor handles personal data for a controller, UK GDPR requires a written agreement with specific terms.
Who is the controller and who is the processor?
The controller decides why and how data is processed; the processor acts on the controller's instructions.
How Legal Lift helps
Answer a few plain-English questions and our AI generator produces a tailored data processing agreement, ready to edit, download as PDF or Word, and e-sign with LegalSign. Every template is kept current with UK law, and our SRA-regulated solicitor partners are available if you'd like it reviewed.
Create your data processing agreement
Generate, edit and e-sign in minutes. From £19.99/mo.
Start free trial