Data processing agreements for outsourcing (UK)

Key takeaways

A data processing agreement for outsourcing is the written contract UK GDPR requires whenever a provider handles personal data on your behalf. It sets out what the provider may do with the data, how it protects it, which sub-processors it uses, how it helps you with rights and breaches, and what happens at the end.

• Required whenever a BPO provider processes personal data you control.
• The ICO lists minimum terms: instructions, confidentiality, security, sub-processors and more.
• Offshore work also needs a transfer safeguard such as the IDTA.
• Breach terms should require the provider to tell you without undue delay.
• Check the DPA matches reality: where data sits, who accesses it, which tools.

What is a data processing agreement?

A data processing agreement (DPA) is a contract between a controller, the organisation that decides why and how personal data is used, and a processor, an organisation that handles that data on the controller's behalf. UK GDPR requires one in writing whenever a processor is used.

In business process outsourcing (BPO), you are usually the controller and the provider is the processor. The DPA can be a standalone document or a schedule in the main contract.

• What is BPO and how can it help UK businesses?

When do you need a DPA?

You need a DPA whenever an outsourced team will access, store, use or delete personal data that you control. That covers almost all customer support, call answering, CRM work, data entry and finance admin, because names, emails, phone numbers and order details are personal data.

A provider that argues it does not need a DPA for this work is either misunderstanding its role or hoping you will not ask.

• outsourced customer support for UK SMEs

What must a DPA include?

The ICO sets out the minimum terms a controller-processor contract must contain, along with details of the processing itself.

• Subject matter, duration, nature and purpose of the processing.
• Types of personal data and categories of individuals.
• Processing only on your documented instructions.
• Confidentiality duties for people handling the data.
• Appropriate technical and organisational security measures.
• Conditions for engaging sub-processors.
• Assistance with individuals' rights, breaches and impact assessments.
• Deletion or return of data at the end, and audit rights.

• BPO contract terms to check before signing

How should sub-processors be handled?

A sub-processor is another company the provider uses to process your data, such as a cloud host or a workforce management tool. Under UK GDPR the provider needs your authorisation, either specific or general with notice of changes, and must flow down equivalent obligations. Ask for the current list and how you will be told of changes.

If the team works entirely inside your systems, the sub-processor list is usually short, which is another advantage of that model.

What should the DPA say about breaches?

The DPA should require the provider to notify you without undue delay after becoming aware of a personal data breach, with the information you need to assess it. Controllers must report notifiable breaches to the ICO within 72 hours of becoming aware of them, so any delay by the provider eats into that time.

Agree a named contact on each side and a practical timescale, such as within 24 hours of discovery.

• Data security with an outsourced team

What extra is needed for offshore teams?

If the provider's team is outside the UK in a country without adequacy regulations, the DPA is not enough on its own. You also need an appropriate transfer safeguard, such as the ICO's International Data Transfer Agreement or the UK Addendum, and a transfer risk assessment.

• GDPR and offshore outsourcing

What are the common DPA mistakes?

The common mistakes are signing a generic template that does not describe the actual processing, never reading the sub-processor list, having no practical breach contact, and forgetting the DPA when scope changes. Review it whenever you add a new process or channel.

Another mistake is treating a freelancer or virtual assistant as exempt. If they handle your customers' data, they are a processor too.

• Virtual assistant versus managed BPO team

What does this look like in practice?

At Global Bridge Labs (GBL), every BPO engagement comes with a data processing agreement under UK GDPR, alongside the transfer safeguard needed for delivery from our Sri Lanka hub. Access is role-based and logged, and teams work inside the client's systems, which keeps the processing description short and accurate.

• See client work
• BPO Solutions for UK businesses

Checklist: review a DPA

Check each point before signing.

• The processing description matches what the team will actually do.
• All ICO-required terms are present.
• The sub-processor list is attached and change notice is agreed.
• Breach notification timescale and contacts are practical.
• Security measures are specific, not generic.
• A transfer safeguard is included if the team is offshore.
• Data return and deletion at exit are clear.

Next step

If you are about to sign a DPA with an outsourcing provider, or need one for an existing arrangement, talk to us. 30 minutes, no pitch.