Data processing agreement checklist
What your contract with a supplier that processes personal data for you must include under UK GDPR Article 28.
Templates are guides only. They must be completed and checked by your legal team before use. This is not legal advice.
When you need one
If a supplier processes personal data on your behalf, you are the controller and they are the processor. UK GDPR requires a written contract between you. The ICO's guidance sets out what it must include.
Details the contract must set out
- The subject matter and duration of the processing
- The nature and purpose of the processing
- The type of personal data and the categories of people it is about
- Your obligations and rights as the controller
What the processor must agree to
- Instructions: only process the data on your documented instructions, including on transfers outside the UK.
- Confidentiality: everyone handling the data is bound by confidentiality.
- Security: take appropriate security measures, as Article 32 requires.
- Sub-processors: only use them with your written authorisation, pass on the same obligations and remain liable for them.
- Individuals' rights: help you respond to requests from individuals.
- Assistance: help you with security, breach notification, data protection impact assessments and consulting the ICO.
- End of contract: delete or return the data at your choice, and delete copies unless the law requires them to be kept.
- Audits: give you the information needed to show compliance, and allow audits and inspections.
Also worth checking
- Where the data will be stored, and the safeguards for any transfers outside the UK
- How quickly the supplier will tell you about a personal data breach
- A list of current sub-processors and how you'll be told about changes
Using it in SupplierVault
SupplierVault's privacy assessment records whether a supplier handles personal data, the categories of data and people, where it is held, transfers and sub-processors, and whether the agreement is signed. Use the checklist in Templates when reviewing the supplier's contract. Try it in the live demo.
Templates are guides only. They must be completed and checked by your legal team before use. This is not legal advice.