How to review a data processing agreement under the UK GDPR

A data processing agreement (DPA) is where a controller and a processor set out the terms the UK GDPR requires for processing personal data. Many DPAs are copied from EU forms and need adapting for the UK, particularly for international transfers. This checklist covers Article 28, transfers and the recent statutory changes, and shows how to run the DPA playbook in Word.

Last checked: 17 October 2026. The law changes; check the current position before relying on this page.

First, confirm the roles

A DPA under Article 28 only fits a controller-to-processor relationship. If both parties decide why and how the data is used, they may be independent or joint controllers, and a data sharing agreement (or an Article 26 arrangement for joint controllers) is the right document. Check the description of processing before anything else.

Article 28 checklist

Article 28(3) of the UK GDPR requires the contract to set out the subject matter, duration, nature and purpose of processing, the types of personal data and categories of data subjects, and the controller's obligations and rights. It must also require the processor to:

• process personal data only on the controller's documented instructions, including on transfers;
• ensure that people authorised to process the data are bound by confidentiality;
• take the security measures required by Article 32;
• engage subprocessors only with the controller's prior authorisation (specific or general, with notice of changes and a right to object) and on equivalent terms;
• assist the controller with data subject rights requests;
• assist with security, breach notification, data protection impact assessments and prior consultation;
• delete or return the data at the end of the services, at the controller's choice; and
• make available the information needed to show compliance, and allow and contribute to audits.

Points that cause negotiation

• Breach notification timing. The controller must usually notify the Information Commissioner's Office within 72 hours of becoming aware of a reportable breach. Processors should notify without undue delay; many controllers ask for 24 or 48 hours.
• Audit rights. Processors prefer to offer certifications and reports first, with on-site audits limited in frequency and at the controller's cost.
• Liability. Check whether data protection liability sits inside the main agreement's cap or has its own.
• Subprocessor changes. Check the notice period and what happens if the controller objects.

International transfers: IDTA and UK Addendum

Restricted transfers out of the UK need an adequacy regulation, appropriate safeguards or an exception. For contractual safeguards, the UK uses the International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, both issued by the ICO and in force since 21 March 2022. A DPA that only attaches the EU Standard Contractual Clauses does not cover UK transfers on its own.

Exporters also need a transfer risk assessment. The Data (Use and Access) Act 2025 replaced the old test with a "data protection test" that asks whether protection in the destination is not materially lower than in the UK; the main data protection changes took effect on 5 February 2026. Check the ICO's current international transfers guidance before relying on an older assessment.

UK specifics in an EU-form DPA

• Replace references to the GDPR with the UK GDPR and the Data Protection Act 2018, or cover both if EU data is also processed.
• Name the ICO as the supervisory authority for UK processing.
• Check the governing law and jurisdiction of the DPA match the main agreement.

Review the DPA in Word with LexDraft

1. Open the DPA in Word, open LexDraft from the Home tab and set the jurisdiction chip to UK: England & Wales (or UK: Scotland or UK: Northern Ireland if that is the governing law).
2. Run the quick checks. They are rule-based and run without AI, catching undefined or unused defined terms, broken cross-references, numbering gaps and inconsistent capitalisation.
3. Run the review with the DPA playbook. Findings are graded Critical, High, Medium or Low, and LexDraft flags standard terms that are missing.
4. Accept or reject each proposed redline. Accepted edits land as native Word tracked changes, ready for the other side.
5. Ask the Assistant to explain a clause in plain English or suggest wording for your side. Answers use UK spelling.
6. Look up any case you want to rely on in the Case law tab, then open the judgment on Find Case Law and read it yourself. UK judgments in LexDraft come from The National Archives' Find Case Law service, which only partially represents the activities of the courts and tribunals. Not every judgment or decision is included. Find Case Law does not include judgments from Scottish or Northern Irish courts or tribunals.

LexDraft does not give legal advice and does not summarise judgments. AI output can be wrong, so qualified counsel must check every redline before it goes out.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. LexDraft is not affiliated with or endorsed by The National Archives or any court. Spotted something out of date? Email support@lexdraft.ai and we will fix it.