Data processing agreement: when a UK startup needs one and what goes in it

UK GDPR divides organisations into controllers, who decide why and how personal data is used, and processors, who handle it on a controller's instructions. A SaaS company is a controller of its own data (its users' accounts, its marketing list, its staff) and a processor of its customers' data (the people its customers put into the product). The same company is often both, for different data, and the DPA covers only the second role.

If you decide what happens to the data (for example you use customer data to train a model or sell insights), you are no longer a processor for that purpose: you are a controller, and the legal basis has to come from somewhere else. That is why the clause on "what you may do with the data" in your customer terms matters as much as the DPA itself.

The contract must set out the subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects, and it must oblige the processor to:

• Process the data only on the controller's documented instructions, including on international transfers.
• Ensure the people handling the data are under a duty of confidentiality.
• Keep the data secure with measures appropriate to the risk (Article 32).
• Engage sub-processors only with the controller's general or specific authorisation, on the same terms, and tell the controller of changes so it can object.
• Help the controller respond to individuals' rights requests, and help with security, breach notification, impact assessments and consultations with the ICO.
• Delete or return the data at the end of the contract, unless the law requires it to be kept.
• Make available the information needed to demonstrate compliance, and allow audits.

A document missing any of these is not a compliant DPA, however long it is.

Sub-processors. General authorisation (you may use sub-processors, listed in a schedule or on a web page, with notice of changes and a right to object) is the workable position for a SaaS company. Specific authorisation for each one does not scale.

Breach notification time. UK GDPR says the processor must notify the controller "without undue delay". Customers ask for 24 hours; 48 to 72 hours after becoming aware is a common compromise, remembering that the controller has 72 hours to tell the ICO.

Audits. A right to audit once a year on notice, at the customer's cost, satisfied in the first instance by a report or certification (SOC 2, ISO 27001) if you have one.

Liability. Customers want DPA liability outside the general cap in the main agreement. A separate, higher cap for data protection breaches is the usual outcome; uncapped liability is not.

International transfers. If data leaves the UK (a US cloud provider, a support team abroad), the transfer needs a lawful mechanism: an adequacy decision, the UK's International Data Transfer Agreement, or the EU standard contractual clauses with the UK addendum. The DPA should say which you rely on.

Attach the DPA as a schedule to your customer terms, so it is accepted with them, and keep a sub-processor list on a page you can update. Your privacy policy covers the data you control; your retention and breach response policy is what lets you meet the deletion and notification promises in the DPA. If you process special category data at scale, or profile people, you will also need a data protection impact assessment before you start.

If customers put personal data into your product, you need a DPA that covers every Article 28 point, a sub-processor list, and a transfer mechanism for anything outside the UK. Having your own means most customers sign yours. The data processing agreement template is £39, or part of the SaaS launch pack with the customer terms and policies it works with.