Controller Processor Agreement Template for England and Wales

When your business needs to share personal data with third-party service providers, a Controller Processor Agreement is not just best practice—it's a legal requirement under UK data protection law. This contract establishes the framework for how personal data will be processed, who is responsible for what, and how both parties will maintain compliance with strict data protection regulations.

When do you need this document?

You need a Controller Processor Agreement whenever you engage a third party to process personal data on your behalf. This includes hiring cloud storage providers, payroll companies, marketing agencies, IT support services, or any vendor that will handle customer information, employee records, or other personal data as part of their services to you. The agreement is also essential when outsourcing activities like customer service, data analysis, or administrative functions that involve access to personal information. Even if the processing seems minimal, UK GDPR requires this formal contract to be in place before any personal data is shared.

Key legal considerations

The processor must only process personal data on your documented instructions and cannot use the data for their own purposes. Your agreement must specify the subject matter, duration, nature, and purpose of processing, along with the types of personal data and categories of data subjects involved. Security measures are crucial—the processor must implement appropriate technical and organizational measures to protect the data, and you retain the right to audit their compliance. The contract must address sub-processing arrangements, requiring your written consent before the processor engages additional parties. Data subject rights provisions are essential, ensuring the processor will assist you in responding to access requests, corrections, or deletion demands. Breach notification procedures must be clearly defined, with the processor required to notify you of any personal data breaches without undue delay.

Legal requirements in England and Wales

Under UK GDPR and the Data Protection Act 2018, Controller Processor Agreements must meet specific statutory requirements set out in Article 28. The contract must be in writing and include mandatory clauses covering processing instructions, security obligations, sub-processor arrangements, and assistance with data subject rights. You must ensure the processor provides sufficient guarantees regarding technical and organizational security measures. The agreement must specify that personal data will be deleted or returned at the end of the contract, unless legal requirements mandate retention. Regular compliance monitoring is your responsibility as the controller, including the right to conduct audits or inspections. The Information Commissioner's Office (ICO) expects these agreements to be comprehensive and actively managed, not merely box-ticking exercises. Non-compliance can result in significant financial penalties and regulatory enforcement action against both parties.