A data processing agreement is a mandatory written contract required under Article 28 of the UK GDPR<\/em><\/a> by virtue of which a controller (the organisation that determines the purposes and means of processing personal data) engages a processor (an organisation processing personal data on the controller\u2019s behalf, strictly in accordance with the controller\u2019s instructions) to process all or some of customers\u2019 or users\u2019 personal data.<\/p>\n The present template deals with the services related to processing of personal data under the article 28-mechanism. If you are looking for a standard type of general service contract,<\/em><\/a> another template should be used instead.<\/p>\n Having a professionally written and valid data processing agreement can be necessary for online and offline businesses in the UK. For example:<\/p>\n Article 28(3) of the UK GDPR sets out the mandatory content of the data processing agreement, they are as follows:<\/p>\n Below are the nine most common pitfalls overlooked by businesses in the UK when creating a data processing agreement from scratch:<\/p>\n Even though UK GDPR mirrors EU GDPR, both documents are not interchangeable. The UK legal framework utilises its own statutory text, which should be aligned with domestic law, including the Data Protection Act 2018. Therefore, using a standard EU GDPR data processing agreement is the mistake number one many businesses in the UK keep making again and again.<\/p>\n Data processing agreements should never incorporate vague, unclear or overly vague provisions. Article 28(3) requires the contract to identify the subject matter, duration, nature, purpose, types of personal data, and categories of data subjects of the processing. All these 6 elements must be addressed directly in the text of the agreement.<\/p>\n The legal obligations that sit with the controller and processor in the UK GDPR are based not on the contractual labelling but rather on the functions both parties perform in the agreement. UK authorities continue to have regard to the well-established EU case law Wirtschaftsakademie Schleswig-Holstein (Case C-210\/16), in which the Court of Justice held that the test for controller status turns on genuine influence over the purposes and means of processing \u2014 not on contractual labelling.<\/p>\n All in all, if the processor in a data processing agreement template starts determining the purposes and means of processing, there is a genuine risk for such a processor to be treated as a controller.<\/p>\n If the processor is under the data processing agreement:<\/p>\n In such a case, an application of Article 28(3)(a) is being triggered, and the introduction of the international transfer clause is mandatory.<\/p>\n The text of the data protection agreement must equip the controller with real and effective measures of regular control and audit related to the processing of personal data. This is right as envisaged by Article 28(3)(h), which allows both technical and physical audits to ensure minimum compliance with the UK GDPR legal framework.<\/p>\n Parties typically fail to discuss in the provisions of the data processing agreement what shall happen with personal data once the contract ends. At the controller\u2019s choice, such data should be either returned, deleted or retained if there are respective legal reasons for such a retention. The absence of such a clause creates a legal gap, since the absence of post-termination obligations poses a high risk towards the security and integrity of personal data in general.<\/p>\n When the parties fail to enter a proper written data processing agreement in line with the UK GDPR, the following negative legal consequences may arise:<\/p>\n Failing to have an Article 28-compliant contract in place is itself a compliance failure that is directly punishable by the Information Commissioner\u2019s Office<\/em><\/a> in the form of taking enforcement action, including fines, for inadequate or absent processor contracts.<\/p>\n It is important to remember that the sole fact of not having a properly written contract is a sufficient breach, which is independent of any underlying data breach.<\/p>\n If something goes wrong, without clear documented instructions, parties cannot identify which measures should be taken next and who is responsible for them. When the leak or breach of personal data takes place, even an insufficient delay in the application of the respective safety measures may cost both parties significant fines imposed by the Information Commission Office.<\/p>\n If sub-processors are involved in the processing of personal data, failure to have a proper written arrangement prevents the controller from having effective measures to make a sub-processor liable for the breach. This is because there is no contractual chain that would otherwise make both the processor and sub-processor liable simply.<\/p>\n Nowadays almost all customers in the UK pay attention to how their personal information is being collected, stored and processed by third parties. Enterprise customers and larger contracting parties increasingly require evidence of a compliant DPA before agreeing to work with a supplier.<\/p>\n Typically, the absence of a proper written data processing agreement in place becomes a commercial barrier for many reputable businesses in the UK.<\/p>\n Follow the instructions below:<\/p>\n <\/p>\n This article is reviewed by\u00a0Daria Turanska<\/a><\/strong>, a lawyer with 15 years\u2019 contract drafting experience. Fact checked by Sarah Collins<\/a>.<\/strong><\/em><\/p>\n","protected":false},"excerpt":{"rendered":" What is a data processing agreement in the UK? A data processing agreement is a mandatory written contract required under Article 28 of the UK GDPR by virtue of which a controller (the organisation that determines the purposes and means of processing personal data) engages a processor (an organisation processing personal data on the controller\u2019s […]<\/p>\n","protected":false},"featured_media":6265,"comment_status":"open","ping_status":"closed","template":"","meta":{"_acf_changed":false},"product_brand":[],"product_cat":[146],"product_tag":[],"class_list":["post-6256","product","type-product","status-publish","has-post-thumbnail","product_cat-ecommerce-legal-templates","first","instock","virtual","purchasable","product-type-simple"],"acf":[],"yoast_head":"\nWhen does a UK business need a data processing agreement?<\/h2>\n
\n
What should be covered in this template?<\/h2>\n
\n
Important UK GDPR pitfalls your data processing agreement must address<\/h2>\n
Generic data processing agreement<\/h3>\n
Absence of clear definitions<\/h3>\n
Confusion of roles<\/h3>\n
International transfers<\/h3>\n
\n
Controller\u2019s Audit Rights<\/h3>\n
Consequences of termination<\/h3>\n
What are the consequences of not having a proper data processing agreement?<\/h2>\n
Direct ICO enforcement exposure<\/h3>\n
Ambiguity of responsibilities<\/h3>\n
Loss of liability chain<\/h3>\n
Reputational and commercial damage<\/h3>\n
How do you sign the data processing agreement with your counterparty?<\/h2>\n
\n