Commissioned Data Processing Agreement Template for England and Wales

When your business needs to engage a third party to handle personal data on your behalf, you must establish a formal legal relationship through a Commissioned Data Processing Agreement. This contract is not optional under England and Wales law—it's a mandatory requirement that must be in place before any personal data processing begins. The agreement creates clear boundaries between you as the data controller and your chosen data processor, ensuring both parties understand their legal obligations and responsibilities under UK data protection legislation.

When do you need this document?

You need a Commissioned Data Processing Agreement whenever you engage external organizations to process personal data on your behalf. This includes hiring cloud storage providers to store customer information, outsourcing payroll services that handle employee data, engaging marketing agencies that process customer contact details, or contracting IT support companies that may access your systems containing personal information. The agreement is also required when working with sub-processors, such as when your primary processor engages additional third parties to fulfill their obligations. Even temporary or project-based processing relationships require this formal documentation to ensure compliance with UK data protection law.

Key legal considerations

Your agreement must clearly define the scope and purpose of processing, specifying exactly what personal data will be processed and for what legitimate purposes. You need to establish comprehensive security measures that both parties must implement, including technical and organizational safeguards appropriate to the risk level. The contract should address data retention periods, deletion procedures, and the processor's obligations regarding data subject rights requests such as access, rectification, and erasure. Sub-processing arrangements require your explicit written authorization, and the processor must ensure any sub-processors provide equivalent protection levels. Breach notification procedures must be clearly outlined, including timescales for reporting incidents and the processor's duty to assist with regulatory notifications and investigations.

Legal requirements in England and Wales

Under the UK GDPR and Data Protection Act 2018, your processing agreement must include specific mandatory clauses covering the subject matter, duration, nature and purpose of processing, categories of personal data, and types of data subjects. The processor must only process personal data on your documented instructions and must not transfer data to third countries without appropriate safeguards and your authorization. You retain legal liability as the data controller for ensuring the processor provides sufficient guarantees regarding technical and organizational security measures. The Information Commissioner's Office (ICO) has enforcement powers to impose significant fines for non-compliance, making proper documentation essential. Your agreement must also address audit rights, allowing you to verify the processor's compliance with their obligations, and must include provisions for contract termination and return or destruction of personal data.