Clause library
Data protection clause, explained
A data-protection clause records how personal data is handled; where one side is a UK GDPR processor, Article 28(3) requires named processor terms.
Last updated 28 October 2026
What does a data protection clause do?
When a supplier processes personal data for a client who is the controller, UK GDPR Article 28 says the processing must be governed by a contract. Article 28(3) lists the processor terms that contract has to contain. The same UK GDPR applies in Scotland. US state privacy laws are a different regime. We put those terms on one shared page.
What must an Article 28 processor contract include?
The contract has to be binding and set out the subject-matter, duration, nature and purpose of the processing, the types of personal data and data subjects, and the controller’s rights. Article 28(3) then requires the processor terms in (a) to (h): documented instructions, confidentialityConfidentiality is a promise to keep shared information private and to use it only for the agreed purpose.More in the glossary, security, sub-processors, assistance, deletion or return, and audit.
When is a party a processor rather than a controller?
A controller decides the purposes and means of processing. A processor processes on the controller’s behalf. A studio storing a client’s customer list to send the client’s emails is usually a processor. A studio that builds its own marketing list is a controller of that list. Name the role for each dataset so Article 28 applies only where it should.
Can the processor appoint sub-processors?
Only with the controller’s prior specific or general written authorisation. On a general authorisation, the processor must tell the controller of intended additions or replacements so the controller can object. The same data-protection obligations have to flow down. The initial processor stays fully liable to the controller for the sub-processor. Write the authorisation method in the clause.
What happens to the data when the work ends?
Article 28(3)(g) says that, at the controller’s choice, the processor deletes or returns the personal data after the services end, and deletes copies unless domestic law requires storage. Pair that with confidentiality and a return-or-destroy line for non-personal confidential files. Name how long logs may be kept if a law requires them.
Example wording
Example · our own drafting
Where the Supplier processes personal data for the Client as a processor, the Supplier will: process that data only on the Client's documented instructions; ensure persons authorised to process it are bound by confidentiality; take the security measures required by UK GDPR Article 32; not appoint a sub-processor without the Client's prior written authorisation; assist the Client with data-subject requests and with Articles 32 to 36; at the Client's choice delete or return the data at the end of the services, unless domestic law requires storage; and make available the information needed to demonstrate compliance and allow audits.
In Plain English
If the supplier handles personal data for the client, it only does what the client has documented, keeps it confidential, looks after security, and does not bring in another processor without written go-ahead. It helps with individual rights and security duties, then deletes or returns the data when the job ends unless the law says it must keep a copy, and it lets the client check.
What should you watch for?
| Point | Watch for | Push for |
|---|---|---|
| Roles | A processor schedule bolted onto a deal where both sides are controllers. | A sentence that names the role for each dataset. |
| Instructions | ‘Process as needed for the services’ with no documented instructions. | A schedule of subject-matter, duration, types of data and data subjects. |
| Sub-processors | A free hand to appoint anyone, or silence. | Prior written authorisation, flow-down, and ongoing liability. |
| End of job | No delete-or-return line. | The controller’s choice, with a lawful-retention carve-out. |
| Cap | An uncapped data indemnityAn indemnity is a promise to cover another party's losses arising from a particular event or claim.More in the glossary on a small fee, or a cap that swallows a breach. | A named position against the liability cap and indemnity. |
Which contracts include it?
Lex includes this clause in, among others:
- Services agreement (master services agreementA master services agreement (MSA) sets the legal terms for an ongoing relationship, with each project then agreed in a separate statement of work.More in the glossary)
- Website build agreement
- Consulting agreement
What does the law say?
Processing by a processor must be governed by a contract that is binding on the processor and sets out the subject-matter and duration of the processing, the nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller, including the processor terms listed in Article 28(3)(a)–(h).
Source: UK GDPR, Article 28(3)Checked 28 October 2026Pending lawyer review
Draft a master services agreement with this clause
Free for the other sideLex drafts it in Plain English beside the legal wording. Share one link; both sides agree and sign.
Frequently asked questions
What does a data-protection clause mean?
It records how personal data is handled under the contract. Where one party processes personal data for the other as a UK GDPR processor, Article 28 requires that processing to be governed by a contract containing named processor terms.
What must a UK GDPR Article 28 processor contract include?
The subject-matter, duration, nature and purpose of the processing, the types of data and data subjects, and the processor terms in Article 28(3)(a)–(h), including documented instructions, confidentiality, security, sub-processors, assistance, deletion or return, and audit.
When is a supplier a processor?
When it processes personal data on the client’s behalf rather than deciding the purposes and means itself. The clause should name the role for each dataset. Article 28 applies to processor relationships.
Can a processor use sub-processors?
Only with the controller’s prior specific or general written authorisation. The same obligations must flow down, and the initial processor remains fully liable to the controller for the sub-processor.
What happens to personal data when the contract ends?
At the controller’s choice, the processor deletes or returns it and deletes copies, unless domestic law requires storage. Write that choice into the clause.
Sources
- UK GDPR, Article 28(3)Checked 28 October 2026Pending lawyer review
Related
The legal wording governsLast reviewed 28 October 2026Pending lawyer review