The Assurance Desk
Part of the guide Who is a data controller, and who is a processor?
When do you need a processor contract?
A controller decides why and how personal data is used. A processor uses it on the controller’s behalf. Each time a controller uses a processor, there must be a written contract that binds the processor for that work.
Before reviewing the wording, settle who does which job. Ask the supplier to describe the data it receives, the work it does and any other firms it uses.
Follow the work through the suppliers
- Controller Decides why and how data is used.Gives instructions
- Processor Uses data on the controller’s behalf.Needs written authorisation
- Sub-processor Helps the processor under equivalent data protection obligations.
What must Article 28 cover?
Start with the details of the job: its subject, duration, nature and purpose. Name the types of personal data and the groups of people concerned. Include the controller’s rights and duties too.
Then check the terms below. A general promise to keep information secret covers only part of this work.
| Term | What the contract needs to cover |
|---|---|
| Instructions | Follow the controller’s written instructions, including transfers, unless UK law requires otherwise. |
| Confidentiality | People who can use the data must be bound to keep it confidential. |
| Security | Take the security measures required by Article 32. |
| Other processors | Obtain written authorisation and pass equivalent data protection duties down the chain. |
| People’s rights | Help the controller respond when people exercise their data rights. |
| Help with risks | Help with security, breach notifications and required impact assessments. |
| End of service | Return or delete data at the controller’s choice; delete copies unless UK law requires storage. |
| Checks | Provide compliance information and allow and contribute to audits and inspections. |
What if the supplier uses another processor?
The supplier needs your prior written authorisation, which can be specific or general. With general authorisation, it must tell you about intended changes and give you a chance to object. Its contract with the next processor must carry equivalent data protection duties.
Ask where the list of suppliers is kept, how changes are sent to you and who receives those notices. Check those details against how your team actually works.
Can the contract work in practice?
Turn each promise into a question. Who receives an urgent request? What information can they provide? Who arranges a data return? Ask for clear answers before agreeing the work.
The ICO recommends being clear about how the processor will help you meet your duties. Use that point to check the practical steps as well as the legal wording.
We recommend that the contract is as clear as possible about how the processor will help the controller meet its obligations.
What to do
- Confirm the controller and processor roles for the actual work.
- Fill in the processing details before reviewing the required terms.
- Check the approval and notice process for other processors.
- Agree how help, checks and the final data handover will work.
Common questions
Does a confidentiality clause cover Article 28?
Confidentiality is one required term. The contract also needs the processing details, instructions, security, assistance, supplier, audit and exit terms.
Who decides whether data is returned or deleted?
The contract must give that choice to the controller at the end of the service. Existing copies must also be deleted unless UK law requires storage.
Where next
Sources
- ICO, What needs to be included in the contract?, checked 7 October 2026
- ICO, When is a contract needed and why is it important?, checked 7 October 2026
This is an independent editorial guide, not legal advice.