UK guide · Updated 9 October 2026 · 18-minute read

What Is a Data Processing Agreement? The 2026 UK Guide to DPAs, Article 28 Clauses and Templates

Table of Contents

Everything a UK business needs to know about data processing agreements: what a DPA is, when you need one, the 14 things it must contain, a clause-by-clause example, how the 2026 data reforms affect it, and how to handle DPAs with marketing tools and offshore suppliers.

By Chenna Reddy, Founder, Digital Masters 360 · Reviewed against UK GDPR Article 28 and ICO guidance · Not legal advice

Get a free DPA & vendor check See prices

What Is a Data Processing Agreement? (The 50-Word Answer)

A data processing agreement (DPA) is a legally binding written contract between a controller — the business that decides why and how personal data is used — and a processor, a supplier that handles that data on its behalf. Under Article 28 UK GDPR it must record the processing details and eight mandatory processor obligations.

Key takeaways

Mandatory, not optional: UK GDPR Article 28(3) requires a written contract whenever a processor handles personal data for you.
14 required elements: 6 processing details + 8 processor obligations (instructions, confidentiality, security, sub-processors, rights, assistance, deletion, audits).
Signed electronically is fine: click-through acceptance of a supplier’s DPA counts, if you keep the evidence.
Not the same as data sharing: controller-to-controller sharing uses a data sharing agreement instead.
Offshore needs more: sending data outside the UK also needs the IDTA or UK Addendum and a data protection test (in force since 5 February 2026).
Fines: up to £8.7m or 2% of global turnover for Article 28 failures.

In this guide

Data Processing Agreement Meaning: Controller, Processor and Sub-Processor Explained

A DPA only makes sense once you know who is who. UK GDPR gives each party a role, and the role, not the job title or company size, decides which contract you need. A small London ecommerce shop using Mailchimp is the controller; Mailchimp is the processor; the cloud provider Mailchimp uses is a sub-processor.

Data protection roles and the contract each one needs
Role	Who it is	Marketing example	Contract needed
Controller	Decides why and how personal data is processed	Your business deciding to email past customers	Signs DPAs with processors
Processor	Processes data only on the controller’s documented instructions	Email platform, CRM, hosting, an agency running your campaigns	Article 28 DPA (mandatory)
Sub-processor	A processor engaged by your processor	The data centre behind your CRM	Back-to-back DPA with the processor
Joint controllers	Two parties jointly decide purposes and means	You and a social network for some ad-targeting features	Article 26 arrangement
Independent controllers	Each decides its own purposes	You sharing a list with a co-marketing partner	Data sharing agreement (good practice)

Is a data processing agreement a contract?

Yes. A DPA is a legally binding contract (or another legal act binding the processor). It can be a standalone agreement, a schedule, an addendum or clauses inside your main services contract. Article 28(9) requires it to be in writing, including in electronic form.

DPA vs data processing addendum vs data processing clauses

These are different names for the same thing. SaaS providers usually call it an “addendum” because it attaches to their terms of service; law firms often call it “data processing clauses” or a “processing schedule”. In the US, the closest term is a service provider agreement under the CCPA.

How do you decide who is the controller?

Ask these questions. The more you answer “yes” for a party, the more likely it is a controller:

Did it decide to collect the data, or the legal basis for it?
Does it decide what the data is used for, who it is about and how long it is kept?
Does it use the data for its own business purposes (for example to improve its own products)?
Does it have a direct relationship with the people the data is about?
Does it apply its own professional judgement, as an accountant or solicitor does?

Common misclassifications in digital marketing

“Our agency picks the targeting, so it’s a controller.” Not necessarily. Choosing technical means on your behalf is still processing; it becomes a controller if it uses your data for its own purposes.
“Freelancers don’t need contracts.” A freelancer who logs into your CRM is a processor, however small.
“Big platforms are just tools.” Some ad and analytics features make the platform a joint or independent controller; read which data processing terms apply.

When Is a Data Processing Agreement Required?

You need a DPA before any supplier starts processing personal data on your behalf. “Personal data” includes names, emails, phone numbers, IP addresses, cookie IDs, order histories and ad-audience lists.

12 everyday situations: DPA or not?

When a data processing agreement is required
Situation	Supplier’s usual role	DPA needed?
Email marketing platform (Mailchimp, Klaviyo, Dotdigital)	Processor	Yes (accept their DPA)
CRM (HubSpot, Salesforce, Zoho)	Processor	Yes
Google Analytics 4 / Google Ads	Processor for most features	Yes (Ads Data Processing Terms)
Website hosting and managed WordPress	Processor	Yes
Marketing agency running your ads, CRM or email	Processor	Yes
Offshore virtual assistant answering customer emails	Processor	Yes + transfer mechanism
Payroll bureau	Processor	Yes
Call-answering or live-chat service	Processor	Yes
Accountant or solicitor	Usually independent controller	No Art 28 DPA; contract with confidentiality
Recruitment agency	Usually independent controller	Data sharing terms
Co-marketing partner sharing a list	Independent controller	Data sharing agreement
Logo designer with no access to personal data	Not processing personal data	No

When you don’t need a DPA

Your own employees act under your authority; use employment contracts and policies instead.
Controller-to-controller sharing uses a data sharing agreement.
No personal data is involved (truly anonymous statistics, stock imagery, design work).

Data processing agreement or data sharing agreement?

	Data processing agreement	Data sharing agreement
Relationship	Controller → processor	Controller ↔ controller
Legal basis	Article 28 UK GDPR (mandatory terms)	ICO Data Sharing Code (good practice)
Who decides purposes	Controller only	Each party for itself
Typical example	Your CRM provider	Two charities sharing donor data

Who signs a DPA, and when?

An authorised signatory of each party signs before processing starts. E-signatures and click-through acceptance are fine. If you are adding a DPA to an existing relationship, sign it now and note the date; don’t backdate.

What if a supplier refuses to sign your DPA?

Large platforms rarely sign customer paper; they offer a standard DPA instead. Review it against the Article 28 checklist below and record your decision. If a smaller supplier will not accept any Article 28 terms at all, don’t give it personal data.

What Must a Data Processing Agreement Include? The Article 28 Checklist

UK GDPR lists exactly what goes in. Most competitor guides stop at a summary; here is the full list with plain-English meaning, so you can check any DPA in ten minutes.

Part 1: The 6 processing details (Article 28(3))

The six processing details every DPA must record
Detail	What to write	Marketing example
Subject matter	What the processing is about	Managing the client’s email newsletter
Duration	How long it lasts	For the term of the services agreement
Nature and purpose	What is done and why	Storing contacts, sending campaigns, reporting opens
Types of personal data	Which data fields	Name, email, location, purchase history, engagement data
Categories of data subjects	Whose data	Customers, subscribers, website visitors
Controller’s obligations and rights	What the controller must and may do	Give lawful instructions, approve sub-processors, audit

Part 2: The 8 mandatory processor terms

The eight Article 28(3) processor obligations
Article	Term	Plain English
28(3)(a)	Documented instructions	Process only as instructed in writing, including on international transfers
28(3)(b)	Confidentiality	Everyone with access is bound by confidentiality, including contractors
28(3)(c)	Security	Take the Article 32 security measures appropriate to the risk
28(3)(d)	Sub-processors	Use others only with prior written authorisation and pass the same terms down
28(3)(e)	Data-subject rights	Help the controller answer access, erasure and other rights requests
28(3)(f)	Assistance	Help with security, breach notification, DPIAs and prior consultation
28(3)(g)	End of contract	Delete or return all personal data at the controller’s choice
28(3)(h)	Audits and information	Provide information to demonstrate compliance and allow audits; flag unlawful instructions

Documented instructions: the heart of every DPA

Instructions should be written into the DPA (usually an annex) and updated in writing, for example by email or a ticket, whenever scope changes.

Instructions on international transfers

The processor may only transfer data outside the UK on your documented instructions, unless the law requires it. Name the countries and the transfer mechanism.

The “unlawful instruction” duty

The processor must immediately tell you if it thinks one of your instructions breaks data protection law. Good DPAs say what happens next (pause, escalate, terminate).

Sub-processors: specific vs general authorisation

Specific authorisation means you approve each sub-processor by name. General authorisation means you approve a list and the processor must notify you of changes so you can object.

What a good sub-processor clause includes

A current list (name, service, location, transfer mechanism)
Advance notice of changes (commonly 14–30 days)
A right to object and, if unresolved, to terminate
The processor stays fully liable for its sub-processors

Watch for silent changes

A clause saying the processor may change sub-processors “by updating its website” without notifying you weakens your control. Ask for email notifications or a subscribe link.

Breach assistance and the 72-hour clock

The processor must notify you without undue delay. You then have 72 hours from becoming aware to report a notifiable breach to the ICO. Set a firm contractual deadline (24–48 hours) and list what the notice must contain.

Recommended clauses the law doesn’t list (but you should add)

Good-practice clauses beyond Article 28
Clause	Why it matters
Breach notice deadline in hours	Turns “without undue delay” into something measurable
Liability and indemnities	UK GDPR doesn’t allocate contract liability; the ICO recommends you agree it
Audit logistics	Notice period, frequency, who pays, whether certificates (ISO 27001, SOC 2) suffice
Annex A: technical and organisational measures (TOMs)	Specific security measures, not “industry standard”
Annex B: sub-processor list	Name, purpose, location, transfer mechanism
Annex C: transfer mechanism	IDTA or UK Addendum where data leaves the UK
AI and model-training clause	No use of your data to train or improve the supplier’s AI models without consent
Data location	Where data is stored and accessed from
Deletion certificate	Written proof of deletion at the end
Order of precedence	The DPA prevails over the main terms on data protection points

Data Processing Agreement Example: What a UK DPA Looks Like

Most UK DPAs follow the same anatomy. A good one for a small business is 5–10 pages including annexes.

Section	What it says	Typical length
1. Parties and definitions	Who is controller and processor; UK GDPR terms	½ page
2. Scope and instructions	Links to Annex 1 processing details	½ page
3. Processor obligations	The 8 Article 28(3) terms	2 pages
4. Sub-processing	Authorisation, notice, objection	½ page
5. International transfers	Countries, IDTA/Addendum	½ page
6. Breaches	Deadline, content of notice, cooperation	½ page
7. Audits	Information, audits, certificates	½ page
8. Liability, term, termination	Caps, survival, deletion	1 page
Annexes 1–4	Processing details, TOMs, sub-processors, transfer terms	2–4 pages

Sample DPA wording (plain-English examples)

These short examples show the style of each clause. They are illustrations to help you recognise good wording, not a complete agreement.

Instructions clause

“The Processor shall process Client Personal Data only on the Client’s documented instructions as set out in Annex 1 or as later given in writing, including with regard to transfers outside the United Kingdom, unless required to do so by UK law.”

Breach notification clause

“The Processor shall notify the Client without undue delay, and in any event within 24 hours, after becoming aware of a Personal Data Breach, providing the information listed in Annex 2.”

AI training clause

“The Processor shall not use Client Personal Data, or any output derived from it, to train, fine-tune or improve any artificial intelligence model, except with the Client’s prior written consent.”

Where to get a data processing agreement template (UK)

UK DPA template sources compared
Source	Good for	Watch out for
ICO contracts guidance and checklist	Checking any DPA against the law	No ready-made template
DMA DPA template	UK marketers and agencies	Adapt the annexes to your real processing
Law Society and law-firm precedents	Bespoke or higher-risk processing	Usually paid; need legal input
Supplier’s standard DPA	SaaS tools you can’t negotiate with	Check the sub-processor and AI clauses
EU Commission controller–processor SCCs	EU-facing businesses	EU instrument; check UK fit
Online generators	A first draft	Generic; often miss annexes and transfers

Template red flags

Blank or “as agreed” annexes
No transfer clause when the supplier is overseas
Unlimited right to change sub-processors
“Industry-standard security” with no detail
Refers to the EU GDPR only, not UK GDPR
Pre-2022 EU SCCs (no longer valid for UK transfers)

What Changed for Data Processing Agreements in 2026?

The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025 and most of its data protection changes came into force on 5 February 2026. Here is what that means for your DPAs:

Data (Use and Access) Act 2025 changes relevant to DPAs
Area	What changed	What to update in your DPA
Article 28 contract terms	No change	Nothing required
International transfers	New “data protection test”: protection must be not materially lower than in the UK, assessed reasonably and proportionately	Transfer annex and your transfer assessment
Existing IDTA / UK Addendum	Mechanisms validly signed before commencement remain effective	Keep them; assess new transfers under the new test
Subject access requests	Searches need only be reasonable and proportionate	Assistance clause: how the processor helps you search
Complaints	Controllers must handle data protection complaints (phased)	Ask processors to help with complaints
Automated decision-making	More permitted with safeguards	Instructions if the supplier uses ADM
Regulator	ICO restructuring into the Information Commission	Update references when the change takes effect
EU adequacy for the UK	Renewed in December 2025 until 27 December 2031	EU-to-UK flows continue freely

What did not change

You still need a written Article 28 contract with every processor.
The 14 required elements are the same.
The 72-hour breach reporting rule is the same.
Fines for Article 28 failures are the same (up to £8.7m or 2%).

Data Processing Agreements With Offshore Processors (India, US and EU)

Is a DPA enough to send UK personal data to India?

No. The DPA governs the processor relationship; a restricted transfer to a country without UK adequacy regulations, such as India, also needs a transfer mechanism and a documented assessment. When someone in India views your CRM remotely, that access can itself be a restricted transfer.

IDTA vs UK Addendum

	IDTA	UK Addendum to EU SCCs
What it is	UK’s International Data Transfer Agreement	Add-on that makes the EU SCCs work for UK transfers
Best for	UK-only businesses	Businesses transferring EU and UK data together
In force since	21 March 2022	21 March 2022

The data protection test in practice

Map what data goes where and who can access it.
Choose the mechanism (IDTA or Addendum).
Assess, reasonably and proportionately, whether protection would be not materially lower than in the UK.
Add supplementary measures if needed (encryption, access controls, pseudonymisation).
Record the assessment and review it when circumstances change.

Minimise what leaves the UK

The best transfer is the one you don’t make. Give offshore teams role-based access to the tools they need, mask or exclude personal data where the task allows, and keep data stored in UK or EU regions.

Transfers to the US

Since 12 October 2023, the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”) lets you transfer to US organisations certified under it. Check certification; if absent, use the IDTA or Addendum.

Transfers to the EU and EEA

UK law recognises the EEA as adequate, so UK-to-EEA transfers flow freely. The EU renewed its adequacy decisions for the UK in December 2025, valid until 27 December 2031.

Data Processing Agreements for Digital Marketing and AI Tools

A typical UK small business uses 10–20 marketing tools that touch personal data. Each needs a DPA or a recorded decision that it isn’t a processor. Here is how the common ones handle it:

Marketing tools and their data processing agreements
Tool type	Examples	How the DPA usually works	What to check
Analytics and ads	Google Analytics 4, Google Ads	Accept data processing terms in the account	Data sharing settings, retention, Consent Mode
Social ads and pixels	Meta, LinkedIn, TikTok	Platform business-tool terms; some features are controller-to-controller	Which terms apply; consent before pixels fire
Email and SMS	Mailchimp, Klaviyo, Dotdigital	DPA incorporated into terms or signable	Sub-processor list, data region
CRM	HubSpot, Salesforce, Zoho	Standard DPA	Who in your team has export rights
Ecommerce	Shopify, WooCommerce hosting	Platform DPA; host DPA	Apps installed and their own DPAs
Session recording	Hotjar, Microsoft Clarity	Standard data processing terms	Masking of form fields
Automation	Zapier, Make, n8n (cloud)	Standard DPA	Every connected app becomes part of the chain
Generative AI	ChatGPT, Claude, Gemini (business tiers)	Commercial and API terms with a DPA	Training opt-out, retention, data region

AI tools: the clause most DPAs are missing

Consumer AI accounts often have different data terms from business or API plans. Before staff paste customer data into an AI tool, confirm a DPA covers it.

6 questions to ask any AI vendor

Is there a DPA for this plan?
Is our data used to train models, and can we opt out?
How long are prompts and outputs retained?
Where is data stored and processed?
Which sub-processors are involved?
Can we delete our data on request?

How to Put a Data Processing Agreement in Place: 9 Steps

1. List every supplier that touches personal data

Pull your card statements and app logins: every subscription is a candidate.

2. Decide each supplier’s role

Processor, joint controller or independent controller, using the questions above.

3. Collect existing DPAs

Download the supplier DPA or accepted terms and save them with the acceptance date.

4. Check them against the 14 elements

Use the Article 28 tables above. Note gaps.

5. Fill gaps with your own DPA or an addendum

For smaller suppliers, send your template; for big platforms, record any residual risk.

6. Add transfer terms for non-UK suppliers

IDTA or UK Addendum, plus your data protection test assessment.

7. Record it in your ROPA

Your Article 30 record of processing should list each processor, purpose and transfer.

8. Update your privacy notice

Name the categories of recipients and explain international transfers.

9. Review yearly and on change

Re-check when a supplier changes sub-processors, region or AI features.

Official resources

DPA Requirements Compared: UK, EU, US, Canada, Australia, New Zealand and India

Processor contract requirements by country
Country	Law	Is a processor contract mandatory?	What it’s called
United Kingdom	UK GDPR Art 28, DPA 2018	Yes	Data processing agreement
EU / EEA	EU GDPR Art 28	Yes	DPA / Auftragsverarbeitungsvertrag (DE)
United States (California)	CCPA/CPRA	Yes, for service providers and contractors	Service provider agreement / DPA
Canada	PIPEDA	Accountability requires contractual protection	Data processing or service agreement
Australia	Privacy Act 1988 (APPs 8 and 11)	Not named, but needed in practice for overseas disclosure	Data handling or processing agreement
New Zealand	Privacy Act 2020 (IPP 12)	Needed in practice for agents and overseas disclosure	Processing or agency agreement
India	DPDP Act 2023 and Rules (phased)	Data fiduciaries must engage processors under a valid contract	Data processing agreement

Spelling note for US and Australian readers

This page uses UK English because it targets UK law (organisation, authorisation, licence). US readers will see organization and authorization; Australian English follows UK spelling.

What Happens If You Don’t Have a Data Processing Agreement?

Risk	Detail
Fines	Up to £8.7m or 2% of worldwide annual turnover (Article 83(4) tier)
Enforcement notices	The ICO can order you to put contracts in place or stop processing
Compensation	Individuals can claim for damage under Article 82; processors are liable too if they breach their own duties
Commercial	Enterprise and public-sector buyers audit suppliers’ DPAs; gaps cost contracts

15 common DPA mistakes

No DPA at all with a freelancer or VA
Annexes left blank
Wrong role assigned (controller vs processor)
Sub-processor list never checked
No transfer mechanism for offshore suppliers
Still relying on the old EU SCCs
No breach deadline in hours
No AI training restriction
No deletion certificate at the end
EU GDPR only, no UK GDPR reference
Not recorded in the ROPA
Click-through acceptance not evidenced
Staff using personal AI accounts with customer data
No review when the supplier changes
Assuming the processor carries all the risk

Working With an Offshore Marketing Agency in India: How We Handle Your DPA

Digital Masters 360 is a Hyderabad-based digital marketing agency that works 100% online for clients in the UK, US, Canada, Australia, Europe and Asia-Pacific. When we run your SEO, ads, email or CRM, we are your processor, so we sign a DPA before we see any personal data.

Is it legal to outsource marketing to India under UK GDPR?

Yes, with the right paperwork: an Article 28 DPA, a transfer mechanism (IDTA or UK Addendum) and a documented data protection test.

We keep personal data transfers to a minimum

Most SEO, content and design work needs no personal data at all. Where it does, we work inside your accounts with named, role-based logins rather than exporting data.

Documents we sign with you

Mutual NDA
Services agreement
Data processing agreement (yours or ours)
IDTA or UK Addendum where needed
Sub-processor list (the tools we use)

What we never do

Download customer lists to personal devices
Use your data to train AI models
Add sub-processors without telling you
Keep data after the contract ends

Cost compared with UK agencies

Indicative prices, converted at £1 = $1.33 / €1.15 / A$2.00
Service	Typical UK agency (indicative)	Digital Masters 360
Marketing data-protection audit	£1,500–£4,000	£750 / $998 / €863 / A$1,500
Monthly marketing retainer	£1,500–£5,000/mo	From £495 / $658 / €569 / A$990 per month
White-label partner work	£1,000+/mo	From £395 / $525 / €454 / A$790 per month

Time zones and communication

We run a UK-hours shift: 9:00 am–6:00 pm UK time (1:30–10:30 pm IST during British Summer Time; 2:30–11:30 pm IST from 25 October 2026). US East Coast mornings and Australian afternoons overlap with our IST day.

How we keep in touch

Slack or Teams channel, replies within 4 working hours
Weekly Zoom or Google Meet call
Monthly report with Looker Studio dashboard
Shared task board (Asana, Trello or ClickUp)

Data privacy compliance by market

Market	Law we work to
UK	UK GDPR, DPA 2018, PECR
EU	EU GDPR, ePrivacy rules
US	CCPA/CPRA and state laws, CAN-SPAM
Canada	PIPEDA, CASL
Australia	Privacy Act 1988, Spam Act 2003
New Zealand	Privacy Act 2020
India (our base)	DPDP Act 2023

Contracts, NDAs, payments and onboarding

Contracts

Services agreement under English law on request, with your DPA attached. Monthly rolling after the first three months.

Payments

Invoices in GBP, USD, EUR or AUD by bank transfer, Wise or PayPal.

Onboarding in 7 days

Free check call
NDA and proposal
Contract, DPA and transfer terms
Access set-up with least-privilege logins
Kick-off and 30-day plan

White-label for UK agencies

UK agencies use us as a back office for SEO, content and paid media under their brand. We sign your DPA as your sub-processor, so your client chain stays compliant.

Get a free DPA & vendor check See prices

Packages and Prices

Free DPA & Vendor Check

£0

30-minute call. We list your marketing tools, flag missing DPAs and transfer gaps.

Marketing Data Audit

£750 / $998 / €863 / A$1,500

Vendor and sub-processor inventory, DPA checklist per tool, tag and consent review, written report.

Fix Sprint

£950 / $1,264 / €1,093 / A$1,900

We accept and file vendor DPAs, fix settings, update your processor register and privacy-notice recipient list.

Managed Marketing

From £495/mo / $658 / €569 / A$990

SEO, ads, email or social, delivered under a signed DPA from day one.

What’s included in every package

Signed NDA and DPA
UK-hours contact
Plain-English written findings
No lock-in after month 3

What we don’t do

We are a marketing agency, not a law firm. We don’t draft bespoke legal contracts or give legal advice; for high-risk processing we hand our findings to your solicitor or DPO.

How to Review a DPA a Supplier Sends You: 12 Questions

Does it name UK GDPR, not just the EU GDPR?
Are all 6 processing details filled in?
Are all 8 Article 28 terms there?
Is there a breach deadline in hours?
Is the sub-processor list attached or linked?
Will you be notified of sub-processor changes?
Is there a right to object?
Which countries is data stored or accessed in?
Which transfer mechanism applies?
Is AI training excluded?
Can you audit, or accept certifications?
Is deletion confirmed in writing at the end?

Red flags

The supplier calls itself a controller of your customer data
Liability for data breaches is excluded entirely
“We may change these terms at any time” with no notice
No security annex

Glossary of DPA Terms

Term	Meaning
Controller	Decides why and how personal data is processed
Processor	Processes personal data on the controller’s behalf
Sub-processor	A processor’s own processor
Article 28	UK GDPR article setting DPA requirements
TOMs	Technical and organisational security measures
ROPA	Record of processing activities (Article 30)
IDTA	International Data Transfer Agreement
UK Addendum	Makes the EU SCCs valid for UK transfers
SCCs	Standard contractual clauses
Data protection test	2026 transfer test: protection not materially lower than the UK’s
DPIA	Data protection impact assessment
ICO	Information Commissioner’s Office, the UK regulator

Data Processing Agreement FAQs

What is a data processing agreement in simple terms?

It is the contract you sign with any supplier that handles personal data for you. It tells the supplier what data it can use, for what purpose, how to keep it secure, who else it may share it with, and what to do with it when the work ends. Its purpose is to keep you, the controller, in control.

Is a data processing agreement a legal requirement in the UK?

Yes. Article 28(3) UK GDPR says processing by a processor must be governed by a contract or other legal act, and Article 28(9) says it must be in writing, which includes electronic form. Both the controller and the processor are responsible for having it in place.

What is the difference between a DPA and a data sharing agreement?

A DPA is used when one party (the processor) acts only on the other’s instructions. A data sharing agreement is used when two independent controllers share data and each decides its own purposes. Article 28 terms are mandatory for a DPA; a data sharing agreement is good practice under the ICO’s Data Sharing Code.

Who signs a data processing agreement, the controller or the processor?

Both. The controller (for example your business) and the processor (for example your email platform, CRM or marketing agency) are both parties. Large platforms usually make you accept their standard DPA in account settings or as part of their terms; smaller suppliers often sign yours.

What must a DPA include under UK GDPR?

Six processing details (subject matter, duration, nature and purpose, types of personal data, categories of data subjects, and the controller’s obligations and rights) plus eight processor terms: documented instructions, confidentiality, security, sub-processor rules, help with data-subject rights, help with security, breaches and DPIAs, deletion or return at the end, and audits and information.

Does a DPA have to be a separate document?

No. It can be a clause, a schedule or an addendum to your main services agreement. What matters is that all the Article 28 terms are there, in writing, and binding. Many businesses use a separate schedule because it is easier to review and update.

Does a data processing agreement need a wet-ink signature?

No. Article 28(9) allows electronic form, so e-signatures, signed PDFs and click-through acceptance of a supplier’s online DPA are all acceptable. Keep evidence of what was accepted, by whom and on what date.

Is there an official ICO data processing agreement template?

No. The ICO publishes guidance and a checklist of required terms but no official template. Common UK starting points are the DMA’s DPA template, law-firm and Law Society precedents, and your suppliers’ own DPAs. Always have a template checked against your actual processing.

Do I need a DPA with Google Analytics, Mailchimp or HubSpot?

Yes, if they process personal data for you. These platforms offer standard data processing terms; for Google you accept the Ads Data Processing Terms in your account, and email and CRM tools incorporate a DPA into their terms. Record that you accepted them and list them in your records of processing.

Do I need a DPA with a freelancer, virtual assistant or offshore agency?

Yes, whenever they access personal data on your behalf, such as your CRM, customer emails, ad audiences or analytics. If they are outside the UK, you also need a transfer mechanism such as the IDTA or the UK Addendum to the EU SCCs.

Do I need a DPA with my accountant or solicitor?

Usually not an Article 28 DPA. Professional advisers who apply their own professional judgement and obligations are normally independent controllers. You still need a contract with confidentiality terms, and some advisers will also act as a processor for limited tasks such as payroll.

What is a sub-processor?

A sub-processor is another supplier your processor uses to help deliver the service, for example the cloud host behind your email platform. A processor may only use sub-processors with your prior written authorisation (specific or general) and must pass the same data protection obligations down the chain.

How quickly must a processor report a data breach?

UK GDPR says the processor must tell the controller without undue delay after becoming aware of a breach. Most DPAs set a concrete deadline such as 24 or 48 hours, because the controller then has 72 hours to report notifiable breaches to the ICO.

What happens if you don’t have a data processing agreement?

You breach Article 28. Infringements of controller and processor obligations can attract fines of up to £8.7 million or 2% of worldwide annual turnover, whichever is higher, plus enforcement notices, compensation claims and lost contracts with customers who audit their suppliers.

Is a DPA enough to send UK personal data to India?

No. The DPA covers the processor relationship, but a restricted transfer to a country without UK adequacy regulations, such as India, also needs a transfer mechanism (usually the IDTA or the UK Addendum) and a documented assessment that the data protection test is met. Remote access from abroad can count as a transfer.

Did the Data (Use and Access) Act 2025 change data processing agreements?

The Article 28 contract terms did not change. The Act changed the international transfers regime from 5 February 2026, replacing the old adequacy standard with a ‘not materially lower’ data protection test, and changed related areas such as subject access searches. Review transfer clauses and assistance clauses rather than rewriting the whole DPA.

Is a data processing agreement the same as a data processing addendum?

Yes. Addendum, schedule, clauses and agreement are names for the same Article 28 contract. In the US, the closest equivalent is the CCPA service-provider or contractor contract, which has its own required terms, so a UK DPA is not automatically CCPA-ready.

How long does a DPA last and what happens at the end?

It lasts as long as the processing it covers. At the end, the processor must delete or return all personal data at the controller’s choice (unless law requires storage) and delete existing copies. Ask for written confirmation of deletion.

Get a Free DPA & Vendor Check

Send us your list of marketing tools. Within 2 working days we’ll tell you which DPAs are missing, which transfers need terms, and what to fix first. No obligation.

Email: chennareddy819@gmail.com
WhatsApp: +91 9505971747
Hours: 9:00 am–6:00 pm UK time, Monday–Friday

Book my free check

About the Author, Method and Sources

Chenna Reddy is the founder of Digital Masters 360, a Hyderabad digital marketing agency serving UK and international clients online. He sets up the analytics, CRM and email stacks that DPAs govern.

Method: written from UK GDPR Article 28, ICO contracts and international transfers guidance, the Data (Use and Access) Act 2025 commencement regulations and the December 2025 EU adequacy renewal; checked against the top-ranking UK pages for this topic on 9 October 2026.

Disclaimer: This guide is general information, not legal advice. Get advice for your specific processing.