Generate a UK GDPR Data Processing Agreement. Required under Article 28 UK GDPR when sharing personal data with processors. Plain English. From £9.99.
A GDPR Data Processing Agreement (DPA) is the contract between a controller and a processor that satisfies Article 28 of the UK GDPR. It specifies what personal data the processor handles on the controller's behalf, on what instructions, and with what safeguards. It is the contract Article 28(3) requires to govern the processing.
Whenever your business hands personal data to a third party — a hosting provider, a payroll bureau, a marketing agency, a CRM platform, an analytics tool — and that third party processes the data on your behalf, a DPA must be in place. The absence of one is itself a breach of Article 28.
The subject matter, duration, nature and purpose of the processing; the categories of data subjects and personal data; processor obligations including confidentiality, security measures, sub-processor appointment, data subject rights assistance, breach notification, deletion or return on termination, and audit cooperation; international transfer mechanisms where data leaves the UK; and the controller's documented instructions and warranties.
They can. Article 28 does not require a separate signed document; it requires a contract or other legal act, binding on the processor and in writing, which includes electronic form, containing the Article 28(3) terms (Article 28(3) and (9)). A provider's online terms or data processing addendum can meet that if they cover every Article 28(3) item; check, and keep a copy.
Loading interactive view…