What is a data processing agreement, and when is one required?

What it is

The controller may only use processors that give sufficient guarantees of appropriate measures. The contract, or another legal act, must be in writing and bind the processor to the Art 28(3) terms. A processor must not engage a sub-processor without the controller's written authorisation, and must flow the same terms down.

When you need one

• Whenever a third party processes personal data on your behalf: cloud hosting, payroll bureaux, mailing houses, IT support, shredding. UK GDPR Art 28(3)
• When a processor appoints a sub-processor. Art 28(2), (4)

When it is the wrong document

• When the other party is a controller in its own right: use a data sharing agreement instead.
• When you are joint controllers: you need an Art 26 arrangement. Art 26

Who is responsible

The controller and the processor, both of whom are in breach if the terms are missing.

What it involves

1. Confirm the relationship is controller to processor.
2. Do due diligence on the processor's security.
3. Put the Art 28(3) terms in writing.
4. Approve and record sub-processors.
5. Audit and review, and require deletion or return at the end.

If it goes wrong

Regulatory

Missing or inadequate terms breach Art 28 for both parties. A breach of this duty sits in the standard tier of penalties: up to £8.7 million or 2% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.