Who it's for
- Businesses using suppliers that handle their customers' or staff's personal data
- Agencies, developers and contractors who process data for clients
- Anyone adding a DPA to a freelance or client service agreement
What's included
- About this template — who needs a DPA, with examples
- Part A — The parties and Part B — Details of processing: subject matter, nature, purpose, duration, data subjects, data categories, special category and criminal data
- Part C — 11 clauses: instructions, confidentiality, security, sub-processing, data subject rights, assistance, deletion or return, audit, international transfers, liability and indemnity, term and termination
- Schedule 1 — Approved sub-processors and Part D — Signatures
Save with a bundle: get this plus 5 more documents in the GDPR + Data Protection Compliance Pack for £39.99.
See what's in the bundle →Key points covered
- Article 28 requires a written contract between a controller and each processor
- The processor acts only on documented instructions
- Sub-processors need authorisation and must be bound by the same obligations
- Breaches reported to the controller within 24 hours so it can meet the 72-hour ICO deadline
- International transfers rely on UK adequacy regulations, the IDTA or UK Addendum, or binding corporate rules
- Data deleted or returned at the end, with written confirmation within 30 days
DocPilot templates are drafted from current legislation and official guidance (GOV.UK, legislation.gov.uk and the relevant regulators), checked against those sources and fully re-reviewed every six months. They are not legal advice. How we make our documents →
Read the guide
Related documents
Privacy Policy (UK GDPR)£12.99 · See what's included →Data Breach Notification Letter Pack£12.99 · See what's included →Freelance & Contractor Agreement£14.99 · See what's included →
Questions
When do I need a DPA?
Whenever someone processes personal data on your behalf, such as a payroll provider, email platform, cloud host or IT contractor.
Can it be attached to another contract?
Yes. It works as a standalone DPA or as a schedule to a services agreement.
Does it cover transfers outside the UK?
Yes. Clause 9 requires prior written consent and a UK transfer mechanism such as the IDTA or UK Addendum.
Is it in the GDPR + Data Protection Compliance Pack?
Yes. The Data Processing Agreement is one of the 6 documents in the pack.
Data Processing Agreement
£14.99 · Word + PDF · instant download
Buy — £14.99 →Bought the wrong document by genuine mistake? Our Swap or Refund Promise lets you swap it or get a refund within 14 days.