# Article 28: what must a processor contract say?

Use this checklist to see what the supplier will do with personal data, including when the work ends.

The Assurance Desk. Published 7 October 2026. Last checked 7 October 2026.

Part of the guide [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md).

**The short answer.** A UK GDPR processor contract must describe the work and set out how personal data will be protected. It needs terms on instructions, confidentiality, security, other suppliers, people’s rights, help, audits and what happens when the service ends ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

## When do you need a processor contract?

A controller decides why and how personal data is used. A processor uses it on the controller’s behalf. Each time a controller uses a processor, there must be a written contract that binds the processor for that work ([ICO, When is a contract needed and why is it important?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/when-is-a-contract-needed-and-why-is-it-important/), checked 7 October 2026).

Before reviewing the wording, settle who does which job. Ask the supplier to describe the data it receives, the work it does and any other firms it uses.

**Follow the work through the suppliers**

- Controller: Decides why and how data is used. (Gives instructions → Processor)
- Processor: Uses data on the controller’s behalf. (Needs written authorisation → Sub-processor)
- Sub-processor: Helps the processor under equivalent data protection obligations.

The contract needs to cover the real arrangement, including any further processor.

Source: ICO, What needs to be included in the contract?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 7 October 2026); ICO, When is a contract needed and why is it important?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/when-is-a-contract-needed-and-why-is-it-important/ (checked 7 October 2026)

## What must Article 28 cover?

Start with the details of the job: its subject, duration, nature and purpose. Name the types of personal data and the groups of people concerned. Include the controller’s rights and duties too ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

Then check the terms below. A general promise to keep information secret covers only part of this work ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

**The required terms, in plain English**

| Term | What the contract needs to cover |
| --- | --- |
| Instructions | Follow the controller’s written instructions, including transfers, unless UK law requires otherwise. |
| Confidentiality | People who can use the data must be bound to keep it confidential. |
| Security | Take the security measures required by Article 32. |
| Other processors | Obtain written authorisation and pass equivalent data protection duties down the chain. |
| People’s rights | Help the controller respond when people exercise their data rights. |
| Help with risks | Help with security, breach notifications and required impact assessments. |
| End of service | Return or delete data at the controller’s choice; delete copies unless UK law requires storage. |
| Checks | Provide compliance information and allow and contribute to audits and inspections. |

Source: ICO, What needs to be included in the contract?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 7 October 2026)

## What if the supplier uses another processor?

The supplier needs your prior written authorisation, which can be specific or general. With general authorisation, it must tell you about intended changes and give you a chance to object. Its contract with the next processor must carry equivalent data protection duties ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

Ask where the list of suppliers is kept, how changes are sent to you and who receives those notices. Check those details against how your team actually works.

## Can the contract work in practice?

Turn each promise into a question. Who receives an urgent request? What information can they provide? Who arranges a data return? Ask for clear answers before agreeing the work.

The ICO recommends being clear about how the processor will help you meet your duties. Use that point to check the practical steps as well as the legal wording ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

> "We recommend that the contract is as clear as possible about how the processor will help the controller meet its obligations."
> ICO, Processor contract guidance
> ICO, What needs to be included in the contract?, https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 7 October 2026)

## What to do

1. Confirm the controller and processor roles for the actual work ([ICO, When is a contract needed and why is it important?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/when-is-a-contract-needed-and-why-is-it-important/), checked 7 October 2026).
2. Fill in the processing details before reviewing the required terms ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).
3. Check the approval and notice process for other processors ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).
4. Agree how help, checks and the final data handover will work ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

## Common questions

### Does a confidentiality clause cover Article 28?

Confidentiality is one required term. The contract also needs the processing details, instructions, security, assistance, supplier, audit and exit terms ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

### Who decides whether data is returned or deleted?

The contract must give that choice to the controller at the end of the service. Existing copies must also be deleted unless UK law requires storage ([ICO, What needs to be included in the contract?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/), checked 7 October 2026).

## Where next

- [Who is a data controller, and who is a processor?](https://theassurancedesk.com/guides/data-controller-or-processor.md)
- [Customer security questionnaires: what they ask and how to answer](https://theassurancedesk.com/guides/customer-security-questionnaires-what-they-ask-and-how-to-answer.md)
- [How do I choose a data protection or AI governance adviser?](https://theassurancedesk.com/guides/how-to-choose-a-data-protection-adviser.md)

## Sources

- ICO, What needs to be included in the contract?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/what-needs-to-be-included-in-the-contract/ (checked 7 October 2026)
- ICO, When is a contract needed and why is it important?: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/contracts-and-liabilities-between-controllers-and-processors-multi/when-is-a-contract-needed-and-why-is-it-important/ (checked 7 October 2026)

---

**Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here.