UK Data Processing Agreement Template template.

A Data Processing Agreement (DPA) is a legally binding contract required under UK GDPR Article 28 between a controller (the business that decides why and how personal data is processed) and a processor (the third party that processes personal data on the controller's behalf). A DPA sets out the processor's obligations, the permitted purposes for processing, and the security and compliance requirements both parties must meet.

You need a DPA any time your business shares personal data with a supplier, contractor, or cloud platform that will process that data on your instructions. Common examples: a payroll provider processing employee records, an email marketing platform holding a customer list, a cloud storage or SaaS provider with access to personal data, or a data analytics firm processing customer behaviour data. Under UK GDPR Article 28(3), the controller must not engage a processor without a written DPA in place.

Under UK GDPR Article 28(3), a DPA must specify: (a) the subject matter, duration, nature and purpose of processing; (b) the type of personal data and categories of data subjects; (c) the obligations and rights of the controller. It must also bind the processor to process only on documented instructions, ensure confidentiality, implement appropriate security measures, use sub-processors only with controller consent, help with data subject rights requests, assist with security and breach notification obligations, delete or return all personal data on termination, and provide audit information. This template covers all of these.

Yes. The template includes provisions for international transfers under UK GDPR Articles 46–49, including references to UK adequacy decisions and the International Data Transfer Agreement (IDTA), which is the UK equivalent of the EU's Standard Contractual Clauses. If your processor is outside the UK and there is no UK adequacy decision for that country, you should use an IDTA alongside this DPA.

Yes. This template is drafted against the UK GDPR (retained EU law as amended by the Data Protection, Privacy and Electronic Communications (Amendments etc) (EU Exit) Regulations 2019) and the Data Protection Act 2018. It does not use EU GDPR references — all citations are to the UK framework.

The template is structured from the controller's perspective — it sets out the processor's obligations in line with Article 28. Both a controller appointing a processor and a processor who needs a standard DPA to send to controller clients can use it. If you are a processor, send this template to your controller clients so you both have an appropriate DPA in place.

A non-disclosure agreement (NDA) covers confidential information more broadly — trade secrets, pricing, business plans — without being specific to personal data. A DPA is specific to personal data regulated under UK GDPR. If your engagement involves both personal data and confidential business information, you may need both. Many NDA buyers also need a DPA — see our employee NDA and freelancer NDA templates for contexts where both frequently apply.

Open the DOCX in Word, Google Docs, or LibreOffice. Find-replace the highlighted [FIELDS] — controller details, processor details, the categories of data, the purpose and duration of processing, and governing law. Inline guidance notes explain what to enter in each field.