Data processing agreement

This data processing agreement (the 'Agreement') is made between:

It is entered into in connection with [Principal agreement name and date] (the 'Principal Agreement') under which the Processor supplies [Services] to the Controller.

Data Protection Legislation

The UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any other applicable data protection law, each as amended.

Controller, Processor, Data Subject, Personal Data, Personal Data Breach, Processing, Supervisory Authority

Have the meanings given in the Data Protection Legislation.

Protected Data

Personal Data processed by the Processor on behalf of the Controller under the Principal Agreement.

Subprocessor

Any processor engaged by the Processor to process Protected Data.

Transfer Mechanism

A lawful mechanism for transferring Protected Data outside the UK, as described in clause 11.

Terms used but not defined in this Agreement have the meaning given in the Principal Agreement.

The Controller determines the purposes and means of processing the Protected Data. The Processor processes Protected Data only to provide [Services] and only in accordance with this Agreement.

Each party complies with its own obligations under the Data Protection Legislation. Nothing in this Agreement relieves either party of its own statutory responsibilities.

The Controller must not provide Protected Data outside the categories listed above without agreeing an update to this Annex in writing.

The Processor processes Protected Data only on the Controller's documented instructions, including this Agreement, the Principal Agreement, and any further written instruction given by [Controller authorised instruction contact].

The Processor may process Protected Data where required to do so by law, and will inform the Controller of that requirement before processing unless the law prohibits it.

The Processor will tell the Controller promptly if, in its opinion, an instruction infringes the Data Protection Legislation. Where an instruction requires work outside the scope of the Principal Agreement, the parties will agree any additional charges in writing.

• Access to Protected Data is limited to personnel who need it to provide the Services
• Those personnel are bound by an appropriate duty of confidentiality
• Personnel receive data protection and information governance training appropriate to their role
• Confidentiality obligations survive termination of this Agreement

The Processor implements appropriate technical and organisational measures to protect Protected Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, taking account of the state of the art, the costs of implementation, and the risk to individuals.

The Controller gives general written authorisation for the Processor to engage the Subprocessors listed in Annex E. The Processor will give the Controller at least [Notice period] written notice before adding or replacing a Subprocessor, and the Controller may object on reasonable data protection grounds within that period.

The Processor will impose data protection obligations on each Subprocessor that are no less protective than those in this Agreement, and remains fully liable to the Controller for the Subprocessor's performance.

The Processor will not transfer Protected Data outside the United Kingdom without the Controller's prior written consent, and will not do so unless a Transfer Mechanism is in place.

The Transfer Mechanism for any approved transfer is [Transfer mechanism], supported by a transfer risk assessment where one is required. The Processor will implement any supplementary measures the assessment identifies.

The Processor will notify the Controller without undue delay, and in any event within [Notice period], if it receives a request from a Data Subject relating to Protected Data. The Processor will not respond to the request itself unless the Controller instructs it to.

Taking into account the nature of the processing, the Processor will provide reasonable assistance — including appropriate technical and organisational measures — to help the Controller respond to requests relating to access, rectification, erasure, restriction, portability and objection.

The Processor will notify the Controller without undue delay, and in any event within [Notice period] of becoming aware of a Personal Data Breach affecting Protected Data.

The notification will include, so far as known at the time:

• The nature of the breach, including the categories and approximate number of Data Subjects and records affected
• The likely consequences of the breach
• The measures taken or proposed to address it and mitigate its effects
• A named contact from whom further information can be obtained

The Processor will provide further information as it becomes available, will co-operate with the Controller's investigation, and will not make any public statement about the breach without the Controller's prior written approval unless required by law.

The Processor will provide reasonable assistance with any data protection impact assessment the Controller carries out in relation to the Services, and with any prior consultation with a Supervisory Authority, taking into account the nature of the processing and the information available to the Processor.

The Processor will make available to the Controller the information reasonably necessary to demonstrate compliance with Article 28 of the UK GDPR, and will allow for and contribute to audits and inspections conducted by the Controller or an auditor it appoints.

• Audits are limited to [audit frequency], unless required by a Supervisory Authority or following a Personal Data Breach
• The Controller will give at least [Notice period] written notice
• Audits take place during normal business hours and must not unreasonably disrupt the Processor's operations
• The auditor must not be a competitor of the Processor and must accept reasonable confidentiality obligations
• Each party bears its own audit costs, unless the audit reveals a material breach by the Processor

On termination or expiry of the Principal Agreement, and at the Controller's choice, the Processor will return the Protected Data to the Controller or securely delete it, and will delete any existing copies, within [Notice period].

The Processor may retain Protected Data to the extent required by law. Where it does, it will tell the Controller what it is retaining and why, and will continue to protect it under this Agreement for as long as it is held. On request, the Processor will provide written confirmation that deletion has taken place.

The limitations and exclusions of liability in the Principal Agreement apply to this Agreement, except where the Data Protection Legislation prevents them from applying.

Each party is responsible for any fine or compensation to the extent it results from that party's own breach of the Data Protection Legislation, and the parties will co-operate to apportion liability fairly where both have contributed.

This Agreement takes effect on [Effective Date] and continues for as long as the Processor processes Protected Data on the Controller's behalf. It terminates automatically when the Principal Agreement ends and the obligations in clause 16 have been completed.

Clauses that by their nature should survive termination — including confidentiality, liability and governing law — continue to apply.

If there is a conflict between documents, the following order applies, with the highest first:

1. Any mandatory requirement of the Data Protection Legislation
2. This Agreement, in respect of the processing of Protected Data
3. The Principal Agreement
4. Any other document referred to in either agreement

This Agreement is governed by [Governing law], and the courts of [Jurisdiction] have exclusive jurisdiction over any dispute arising from it.

Signed for and on behalf of the parties by their duly authorised representatives.