Data processing agreement (controller-processor)

Price:  £45.00(Inc. 20% VAT)(£37.50 Exc. VAT)
  (1 Review)

An agreement to help businesses comply with data protection law, including the General Data Protection Regulation (GDPR).

Author: Alasdair Taylor
Updated: 4 January 2021
Length: 10 pages
Notes: 11 pages
Format: MS Word (.DOCX)

This agreement will help data controllers to transfer personal data to data processors in a GDPR-compliant manner.

This document may be used as a stand-alone processing agreement, but more commonly it will be used to supplement and existing contract under which data, including personal data, is processed.

The approach we have taken in preparing this document is to closely shadow the requirements of the GDPR (in both its EU and UK forms). Clauses included in the agreement cover, for example, the obligation on the processor to act only on the instructions of the data controller in relation to the processing of the data, and to delete the personal data after the end of the contract.

The "variables" which may be associated with a data processing agreement, such as identification of data subject categories, are set out in a schedule to the agreement. Another optional schedule may be used to add the standard contractual clauses for international transfers into the agreement.

  1. Definitions
  2. Supplemental
  3. Term
  4. Consideration
  5. Data protection
  6. Limits upon exclusions of liability
  7. Termination
  8. Effects of termination
  9. Notices
  10. General
  11. Interpretation


  1. Categories of data subject
  2. Types of Personal Data
  3. Purposes of processing
  4. Security measures for Personal Data
  5. Sub-processors of Personal Data


Does this document reflect the requirements of the GDPR?

Yes, this is a GDPR-friendly processing agreement. Remember, however, that there is much more to GDPR compliance than having the correct contracts in place.

Can this document be used for processor-to-subprocessor contracts?

It would not be too difficult to adapt for these circumstances, but some changes would be needed – for instance there are at the time of writing no relevant "standard clauses" for international transfers from a processor to a subprocessor.

A copy of this data processing agreement (controller-processor) is included in this pack:

Average rating (1 Review):  
write a review and share your opinions!

Excellent and easy to use
Friday, 21 December 2018  | 

1 hour with this template and I had a more comprehensive DPA than anything I've seen from our clients - and that includes top tier law firms. It's clear, simple and by default includes a wide variety of eventualities. Thank you.


Thanks very much for the review Alexander - really appreciated. The main issue I see with customer DPAs is that they often seek to impose specific procedural obligations on services providers in relation to matters which affect large numbers of other customers (e.g. in relation to the appointment of sub-processors). It usually makes more sense for the services provider to prepare the DPA.