Home > Contracts for services > Services contracts
This agreement will help data controllers to transfer personal data to data processors in a GDPR-compliant manner.
This document may be used as a stand-alone processing agreement, but more commonly it will be used to supplement and existing contract under which data, including personal data, is processed.
The approach we have taken in preparing this document is to closely shadow the requirements of the GDPR (in both its EU and UK forms). Clauses included in the agreement cover, for example, the obligation on the processor to act only on the instructions of the data controller in relation to the processing of the data, and to delete the personal data after the end of the contract.
The "variables" which may be associated with a data processing agreement, such as identification of data subject categories, are set out in a schedule to the agreement. Another optional schedule may be used to add the standard contractual clauses for international transfers into the agreement.
SCHEDULE 1 (DATA PROCESSING INFORMATION)
SCHEDULE 2 (MODEL CONTRACTUAL CLAUSES)
Does this document reflect the requirements of the GDPR?
Yes, this is a GDPR-friendly processing agreement. Remember, however, that there is much more to GDPR compliance than having the correct contracts in place.
Can this document be used for processor-to-subprocessor contracts?
It would not be too difficult to adapt for these circumstances, but some changes would be needed – for instance there are at the time of writing no relevant "standard clauses" for international transfers from a processor to a subprocessor.
A copy of this data processing agreement (controller-processor) is included in this pack:
1 hour with this template and I had a more comprehensive DPA than anything I've seen from our clients - and that includes top tier law firms. It's clear, simple and by default includes a wide variety of eventualities. Thank you.
Response:
Thanks very much for the review Alexander - really appreciated. The main issue I see with customer DPAs is that they often seek to impose specific procedural obligations on services providers in relation to matters which affect large numbers of other customers (e.g. in relation to the appointment of sub-processors). It usually makes more sense for the services provider to prepare the DPA.
1. Online shop pack
2. SaaS pack
3. GDPR pack
4. Software developer pack
5. Business pack
6. Commission and referrals pack
7. Consultancy pack
8. Digital marketing pack
9. Web design and development pack