Search

How can we help?

Icon

What a controller or a processor needs to know…in a nutshell

Data processing agreements (DPAs) are a common feature of contracts for the supply of services, for example often featuring as self-contained schedules to master services agreements (MSAs).

Why are they there?

If the services include, even incidentally, processing of personal data – and processing can include a multitude of operations such as collection, recording, organisation, structuring, storage, alteration, retrieval, erasure or destruction, and even transfer to third parties – then there is a legal requirement for the controller (the customer who, as controller, is the person who determines the purposes and means of personal data processing) to have a DPA in place with the processor (the service-provider).

What does the law require?

The UK GDPR (which is the UK version of the EU General Data Protection Regulation) requires processors’ activities to be governed by a contract (ie a DPA) and sets out (in Article 28) very specific obligations for processors, including:

  • to process personal data only on documented instructions from the controller, subject to certain very limited exceptions;
  • to impose confidentiality obligations on all processor personnel involved in processing;
  • to abide by the rules regarding appointment of sub-processors;
  • to implement measures to assist the controller in complying with data subjects’ rights;
  • to assist the controller in ensuring compliance with the data security requirements of the UK GDPR (Article 28 requires processors to take all measures required to comply with Article 32 of the UK GDPR which imposes specific data security requirements on controllers and processors – these may include pseudonymisation and encryption of personal data. DPAs will often have an annex setting out security measures specifically required by the controller);
  • at the controller’s choice, to return or destroy the personal data at the end of the contract relationship; and
  • to provide the controller with all information necessary for the controller to demonstrate compliance with the UK GDPR’s obligations relating to engaging processors.

Article 28 also provides that the DPA has to set out certain information, including the subject-matter, duration, nature and purpose of the processing, and the types of personal data processed and categories of data subjects. This information is often set out in an Annex to the DPA and, in the case of many services agreements, may well not change from the start of the contract.

One issue which often arises is limitation of liability for breach of a DPA (there is often indemnification of the controller by the processor for breach).

So if it is a largely standard document, do I need to spend any time reviewing it?

The answer is a very firm yes. Notwithstanding the fact that the DPA must contain prescribed clauses, factors such as the nature and sensitivity of the personal data involved and the nature of the services to be carried out by the service-provider mean that each DPA should be reviewed carefully and tailored as necessary to the particular circumstances of the contractual relationship which it underpins.

From a controller point of view, for example, it may be necessary to strengthen and add to the requirements set out in Article 28 given the above factors – for example, by including additional requirements for processor personnel, data security measures and audit rights.

For a processor, unless there is good reason for it, then the processor obligations in the DPA should be as closely aligned to those set out in Article 28 as possible and should not go materially beyond them.

One issue which often arises is limitation of liability for breach of a DPA (there is often indemnification of the controller by the processor for breach). Typically, the services agreement (eg MSA) in which the DPA is contained will have limitations on the liability of the service-provider in relation to breach. The financial consequences of breach of a DPA by a processor are potentially very significant for a controller – eg the cost of restoring lost data and large fines – so there will often be discussion in negotiations about a “super-limit” for DPA breaches. Whilst the customer will base their approach on the size of potential fines, the processor will be putting forward a risk-based argument based on the nature of the services and of the personal data involved to reduce that “super-limit” to something commercially realistic given the value of the contract (and the possibility of insuring all or part of the risk).

And what if there isn’t an adequate DPA in place?

Without a fit for purpose DPA in place in relation to which each party is fully aware of and compliant with its obligations, there is a material risk of enforcement action by the UK Information Commissioner’s Office and potential criminal liability for either or both of the controller and processor. So it’s definitely worth spending some time and effort on getting it right.

Disclaimer
This information is for guidance purposes only and should not be regarded as a substitute for taking legal advice. Please refer to the full General Notices on our website.

Author profile

Jon Chapman

Senior Consultant

View profile

+44 118 960 4683

About this article

Read, listen and watch our latest insights

art
  • 02 September 2025
  • Employment

Social Media – how private is your personal data

Nowadays most people have at least one social media account. Whether it’s Facebook or TikTok, X, or LinkedIn, most adults have an online presence.

art
  • 18 August 2025
  • Privacy and Data Protection

Top 10 DUAA Compliance Tips for Employers

To support your preparation, we have outlined 10 practical tips to help employers navigate the new requirements and take full advantage of the DUAA’s reforms.

art
  • 12 August 2025
  • Privacy and Data Protection

From WeTransfer to WhatsApp: How Unapproved Tools and “Shadow IT” Could Threaten UK GDPR Compliance

Businesses and self-employed professionals are in a constant pursuit of efficiency and productivity.  There are, as a result, no end of tools and products available to smooth digital workflows. 

Pub
  • 14 July 2025
  • Privacy and Data Protection

From legislation to implementation: The Data (Use and Access) Act 2025

In this podcast, our data protection experts, Melanie Pimenta and Harry Berryman, will explain what the Act means for your organisation and how to ensure compliance with the new regulations.

art
  • 01 July 2025
  • Privacy and Data Protection

Data protection compliance: tricky issues for employers

This article highlights key issues organisations may face when processing personal data and stresses the importance of a proactive approach. It also outlines tailored training packages to support compliance and build internal expertise.

art
  • 20 June 2025
  • Privacy and Data Protection

Data Protection reform receives Royal Assent: What is the Data (Use and Access) Act 2025 (DUAA) and what it means for your business

The UK’s data protection framework is about to undergo its most significant change since the UK GDPR came into force. After months of parliamentary debate, the Data (Use and Access) Act 2025 (‘DUAA’) has successfully received Royal Assent.