Data Processing Agreement — Word & PDF Template

This data processing agreement (DPA) sets out the terms on which a processor handles personal data on behalf of a controller, as required by the UK GDPR. It records the processing details, security obligations and rules on international transfers so both parties meet their data protection duties.

Who is this template for?

It is intended for controllers and processors in England and Wales — for example businesses using a supplier, agency or SaaS provider that handles personal data on their behalf. Use it wherever a controller uses a processor and needs a written processing contract.

What does the template include?

The agreement is organised into clearly numbered clauses covering the processing:

• Parties — identifies the controller and the processor.
• Background — context of the arrangement.
• Subject matter and duration of processing — scope and timing.
• Nature and purpose of processing — why data is processed.
• Type of personal data — categories of data.
• Categories of data subjects — whose data is processed.
• Processor’s obligations — documented instructions, security, sub-processors, assistance, breach notification, and deletion, return and audit.
• Controller’s obligations — duties of the controller.
• International transfers — transfers outside the UK.
• Deletion, return and audit — return or deletion of data at the end, and audit rights for the controller.
• Term and termination — duration and ending the agreement.
• Liability and indemnity — responsibility for breaches.
• Governing law — England and Wales jurisdiction.
• Entire agreement — the whole agreement between the parties.
• Signatures — execution by both parties.

Easy to customise

The template works in Microsoft Word, Google Docs and LibreOffice. Fill in the highlighted fields, set out the processing details and remove anything that does not apply.

Format and scope

Supplied as an editable Word (.docx) file and a print-friendly PDF, formatted to A4. Written in plain British English with light, general references to the UK GDPR and England & Wales law.