Data processing agreement (controller-processor)

This agreement will help data controllers to transfer personal data to data processors in a GDPR-compliant manner.

This document may be used as a stand-alone processing agreement, but more commonly it will be used to supplement and existing contract under which data, including personal data, is processed.

The approach we have taken in preparing this document is to closely shadow the requirements of the GDPR. Clauses included in the agreement cover, for example, the obligation on the processor to act only on the instructions of the data controller in relation to the processing of the data, and to delete the personal data after the end of the contract.

The "variables" which may be associated with a data processing agreement, such as identification of data subject categories, are set out in a schedule to the agreement. Another optional schedule may be used to add the standard contractual clauses for international transfers into the agreement.

1. Definitions
2. Supplemental
3. Term
4. Consideration
5. Data protection
6. Limits upon exclusions of liability
7. Termination
8. Effects of termination
9. Notices
10. General
11. Interpretation

SCHEDULE 1 (DATA PROCESSING INFORMATION)

1. Categories of data subject
2. Types of Personal Data
3. Purposes of processing
4. Security measures for Personal Data
5. Sub-processors of Personal Data

SCHEDULE 2 (MODEL CONTRACTUAL CLAUSES)

This document is 21 pages in total, including 11 pages of guidance notes.

Does this document reflect the requirements of the GDPR?

Yes, this is a GDPR-friendly processing agreement. Remember, however, that there is much more to GDPR compliance than having the correct contracts in place.

Can this document be used for processor-to-subprocessor contracts?

It would not be too difficult to adapt for these circumstances, but some changes would be needed – for instance there are at the time of writing no relevant "standard clauses" for international transfers from a processor to a subprocessor.