Data processing agreements: what your software contract must include
If a supplier builds, hosts or supports a system that holds personal data for you, UK GDPR says you need a written contract with certain terms. Here they are, from the ICO.
The short answer
When an organisation (the controller) uses a supplier (the processor) to handle personal data for it, for example a developer who hosts and supports your booking system, UK GDPR Article 28 requires a written contract. It must describe the processing (what, why, how long, whose data) and include eight terms: acting only on your instructions, confidentiality, security, rules for sub-processors, help with people's rights, help with your own duties, deleting or returning the data at the end, and audits.
The processing details
The contract must set out:
- The subject matter and duration of the processing.
- The nature and purpose of the processing.
- The type of personal data and the categories of people it's about.
- Your obligations and rights as the controller.
The eight terms it must include
As the ICO lists them.
- Instructions. The processor only processes the data on your documented instructions, unless the law requires otherwise.
- Confidentiality. Everyone who processes the data is bound by a duty of confidence.
- Security. The processor takes the security measures UK GDPR Article 32 requires.
- Sub-processors. It needs your prior written permission to use a sub-processor, must give the sub-processor equivalent obligations, and stays responsible for them.
- People's rights. It helps you respond when people use their data protection rights.
- Your duties. It helps you with security, personal data breaches, data protection impact assessments and, where needed, consulting the ICO.
- End of contract. At your choice, it deletes or returns all the personal data, and deletes copies unless the law says to keep them.
- Audits. It gives you the information to show it meets Article 28, and allows and contributes to audits and inspections.
In practice
Ask every supplier that touches personal data for you, including whoever builds or hosts your website, booking system or app, for their data processing agreement before work starts. Many have a standard one.
Check where the data is stored and who can reach it. If anyone outside the UK can access it, the international transfer rules apply too.
We sign a data processing agreement with every client before we handle personal data, and keep client data on UK-hosted servers by default.
Sources and related
Sources, checked 20 October 2026: ICO: What needs to be included in the contract?; ICO: When is a contract needed and why is it important?. Rules change, so check the source before you rely on it.
Quick answers
Do I need a data processing agreement with my web developer?
If they handle personal data for you, for example by hosting or supporting a system that holds your customers' details, UK GDPR Article 28 requires a written contract with specific terms.
What must a data processing agreement include?
The processing details (subject matter, duration, nature, purpose, types of data and people, your obligations and rights) and eight terms: instructions, confidentiality, security, sub-processors, help with people's rights, help with your duties, deletion or return at the end, and audits.
Can a processor use a sub-processor?
Only with your prior written permission, and with equivalent data protection obligations in its contract. The processor stays responsible for the sub-processor.
Has the Data (Use and Access) Act changed this?
The ICO says its guidance on controllers and processors is under review since the Act became law on 19 June 2025. Check its current guidance.