Fiducia TogetherData processing agreement
The contract required whenever someone processes personal data for you.
Please note: This page explains what a term means. It is general information, not legal, financial, tax or investment advice, and it does not know anything about your business. Before you sign, file or commit to anything, check it with an accountant, a solicitor, or the official guidance we link to.
What it means
UK GDPR requires a written contract between controller and processor containing specified terms — subject matter, duration, nature and purpose, types of data, obligations and rights.
Why it matters
It is a legal requirement, not best practice, and larger customers will ask for yours as a condition of contracting.
What it looks like in practice
Most SaaS suppliers publish a standard DPA; check it exists and covers sub-processors and international transfers.\n\nInternational transfers need a mechanism — the UK addendum to the standard contractual clauses, or adequacy.
What to watch out for
Sub-processors added without notice. A good DPA requires notification and a right to object.
Where to get proper advice
The ICO publishes what the contract must contain. A solicitor for high-volume or sensitive processing.
Where to read more
Last reviewed 2026-08-28 by Fiducia Together · Next review due 2027-08-28
Please note: This page explains what a term means. It is general information, not legal, financial, tax or investment advice, and it does not know anything about your business. Before you sign, file or commit to anything, check it with an accountant, a solicitor, or the official guidance we link to.