Data processing agreements

What the engagement delivers

We map the parties’ roles and processing activities, review instructions and subcontracting arrangements, and negotiate clauses for assistance, security, incidents, retention and exit.

1. Define the service and the information handled by each party.
2. Compare the processing description with supplier terms and technical schedules.
3. Prepare proposed clauses and an issue list for negotiation.
4. Hand over the agreed document version and unresolved operational commitments.

Keep commercial terms, processing instructions and security descriptions consistent. A broad promise in one schedule should not obscure an exception in another document.

Information to organise

• Services agreement
• processing description
• data categories
• subprocessor list
• locations
• security schedule
• deletion capabilities.

Identify who can change instructions, which suppliers participate and what happens to information at the end of the service. Distinguish deletion from active systems, retained records and backup treatment in the factual brief. Ask the responsible technical team to confirm capabilities before contractual wording describes them.

A design or evidence issue to resolve

A vendor may use some information only on instructions and other information for its own purposes. The agreement should address the actual roles rather than assign one label to everything.

For example, a payroll supplier may rely on another provider for support tooling. The assessment should identify what information reaches that provider, its role and the relevant contractual chain. The named contracting party alone does not describe every recipient in the service.

Boundaries and next steps

Cross-border or sector-specific advice and third-party negotiations are defined in the proposal. A contract does not by itself establish that the technical controls operate.

The written scope identifies products, entities, jurisdictions, deliverables and fees. Share an initial description rather than confidential source code or personal datasets through the public enquiry form.

The completion pack identifies the processing schedule, negotiated changes and commitments requiring implementation or evidence. Supplier onboarding, ongoing monitoring and technical assurance remain separate unless expressly included. If the service or supplier chain changes, the processing description should be reassessed before reusing the earlier agreement.