Processor contracts and sub-processing

A controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. may use only processorsProcessorProcesses personal data on a controller's instructions, such as a cloud host or payroll bureau, with its own security and breach duties. that give sufficient guarantees, and the relationship must be governed by a binding contract with specific terms. The terms are not optional drafting: a contract missing them is an infringement by both parties.

The mandatory terms

The contract must set out the subject matter, duration, nature and purpose of the processing, the types of personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. and categories of data subject, and the controller’s obligations and rights. It must require the processor to:

1. Process only on the controller’s documented instructions, including on transfers, and tell the controller if an instruction infringes the law.
2. Ensure people authorised to process the data are under a duty of confidence.
3. Take the security measures Article 32 requires.
4. Engage sub-processors only with authorisation and on equivalent terms.
5. Assist the controller with data subject rights.
6. Assist with security, breach notification, DPIAs and prior consultation.
7. Delete or return all personal data at the end of the service.
8. Make available the information needed to demonstrate compliance, and allow and contribute to audits and inspections.

Sub-processing

Authorisation can be specific (each sub-processor approved) or general (a list, with notice of changes and a right to object). Under a general authorisation the processor must tell the controller of intended changes so the controller can object. The processor stays fully liable to the controller for its sub-processors.

Where a processor becomes a controller

If a processor uses the data for its own purposes, it is a controller for that processing, with all the obligations that brings and none of the contract’s protection. The classic cases: using client data to train its own products, benchmarking across clients, and marketing to data subjects. Read the processor’s terms for “service improvement” clauses that do exactly this.

Liability

A processor is directly liable for compensation where it has not complied with obligations specifically directed at processors, or has acted outside or contrary to lawful instructions. The regulator can fine processors directly: the first UK GDPR penalty on a processor, £3.07m in March 2025, followed a ransomware attack on a supplier to the NHS.

A short negotiation checklist

• Are the instructions specific enough to audit against?
• Is the sub-processor list current, and is there a real right to object?
• Is breach notice to you fast enough to meet your 72 hours?
• Do audit rights work in practice, or only on paper?
• Is deletion at exit certified?
• Are international transfers by the processor covered by a UK route?