Data Processing Agreement in United Kingdom: Template, Key Clauses and Local Law (2026)

Is a data processing agreement legally required in the United Kingdom? Yes. Under the UK GDPR and the Data Protection Act 2018, a controller must have a written contract in place whenever it uses a processor to handle personal data on its behalf. This is not optional. Article 28 of the UK GDPR sets out the mandatory terms that contract must contain, and the Information Commissioner's Office (ICO) enforces the requirement. A DPA can be a standalone document or a schedule to a main services or SaaS agreement. This is general information, not legal advice. For cross-border data flows or high-risk processing, ask a qualified UK solicitor or data protection adviser. ## What UK law requires in a DPA ### UK GDPR Article 28

Article 28 requires the contract to set out the subject matter, duration, nature, and purpose of the processing, the type of personal data, and the categories of data subjects, and to bind the processor to a specific set of obligations. The ICO publishes guidance and a checklist of the required terms, and its model controller-to-processor clauses can be used. ### Data Protection Act 2018 The 2018 Act sits alongside the UK GDPR and covers areas such as law enforcement and intelligence processing, exemptions, and the ICO's powers. ### Data (Use and Access) Act 2025 This Act, which received Royal Assent on 19 June 2025, reforms parts of the UK data regime. The core Article 28 contract requirement remains, but some surrounding rules have changed, so rely on current ICO guidance rather than older summaries. ### International transfers If personal data leaves the UK to a country without UK adequacy, you need a transfer mechanism such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, plus a transfer risk assessment. ## Key clauses in a UK data processing agreement ### Roles and definitions Identify the controller and the processor, and use UK GDPR definitions of personal data, processing, and data subject. ### Details of processing The Article 28 core: subject matter, duration, nature and purpose, types of personal data, and categories of data subjects, usually in an annex. ### Processing on documented instructions The processor may process personal data only on the controller's documented instructions, including on international transfers. ### Confidentiality The processor must ensure staff handling the data are bound by confidentiality. ### Security measures Appropriate technical and organisational measures under Article 32, set out specifically, not vaguely. ### Subprocessors No subprocessor without the controller's prior authorisation, with flow-down of equivalent obligations and the processor staying liable. ### Assistance The processor must help the controller respond to data subject rights requests, and assist with security, breach notification, and data protection impact assessments. ### Breach notification The processor must notify the controller without undue delay after becoming aware of a personal data breach, so the controller can meet its own 72-hour ICO deadline where it applies. ### Return or deletion At the end of the contract, the processor must return or delete the personal data and delete existing copies, as the controller chooses. ### Audits The processor must make available information to demonstrate compliance and allow audits. ### International transfers Include the IDTA or UK Addendum where data leaves the UK to a non-adequate country. ## A simple UK DPA skeleton 1. Parties and roles (controller and processor) 2. Definitions (UK GDPR) 3. Details of processing (annex) 4. Processing on documented instructions 5. Confidentiality 6. Security measures (annex, Article 32) 7. Subprocessors and authorisation 8. Assistance with data subject rights and compliance 9. Personal data breach notification 10. International transfers (IDTA or UK Addendum) 11. Audits and information 12. Return or deletion of data 13. Liability and indemnity 14. Term, precedence, and governing law ## Points worth negotiating Make the security annex specific, because "appropriate measures" alone is weak. Tighten the breach-notification window so you can meet your own ICO deadline. Nail down subprocessor authorisation and your right to object. Confirm in writing whether the processor uses your data to train AI models. For data leaving the UK, get the IDTA or UK Addendum and a transfer risk assessment in place. Align the DPA liability with the main contract so a breach is not quietly excluded. ## Where a single contract workspace helps DPAs rarely travel alone: each attaches to a main agreement, references a security annex, lists subprocessors, carries a breach-notice window, and may need an IDTA for transfers. Keeping all of that consistent across many processors is the real work, and it is what an AI contract workspace is built for. Each agreement becomes a structured clause tree with positions marked favourable, neutral, or unfavourable to your company, and obligations surface automatically. Adira is one such workspace. Adira is India-first today, and deeper United Kingdom data protection coverage is on its roadmap, so for UK-governed DPAs treat it as a drafting and tracking aid and confirm the exact Article 28 and transfer requirements against current ICO guidance with a UK adviser. The clauses above do not change; a workspace just makes them easier to manage.