Under UK GDPR, if you share personal data with a third party who processes it on your behalf - a cloud software provider, a payroll bureau, a marketing agency - you are the data controller and they are the data processor. The law requires you to have a written Data Processing Agreement (DPA) in place. Many SMEs overlook this entirely.
Controller vs processor - the key distinction
A data controller determines the purpose and means of processing. A data processor acts on the controller's instructions. If you give personal data to a payroll provider and they process it to pay your employees, you are the controller and they are the processor.
This matters because as the controller, you remain responsible for ensuring the processor handles the data lawfully and securely. The DPA is the contractual mechanism for that.
When is a DPA required?
A DPA is required whenever a third party processes personal data on your behalf. Common examples for SMEs:
- Cloud-based CRM or customer management systems
- Payroll bureaux or HR software providers
- Accountancy and bookkeeping platforms
- Email marketing platforms (Mailchimp, etc.)
- IT support providers with access to your systems
- Recruitment platforms handling candidate data
- Any outsourced function involving personal data
What a DPA must contain
Article 28 of UK GDPR sets out the required content. A compliant DPA must include:
- The subject matter, duration, nature and purpose of the processing
- The type of personal data and categories of data subjects involved
- The controller's obligations and rights
- A requirement that the processor only acts on documented instructions
- Confidentiality obligations on processor staff
- Security requirements appropriate to the risk
- Rules on sub-processing (the processor must not engage sub-processors without your authorisation)
- Assistance obligations for Subject Access Requests and breach notification
- Data return or deletion on termination of the agreement
- Audit rights for the controller
What to do if a supplier doesn't offer a DPA
Most established software providers will have a standard DPA - check their legal or privacy pages, or contact their support team. If a supplier refuses to enter into a DPA, you should not share personal data with them. Using a supplier without a DPA in place is itself a breach of UK GDPR.
Manage this inside Jojan One
Jojan One tracks your obligations, flags what needs attention and keeps the evidence, so you are always audit-ready.
Start your free trial