United Kingdom Controller Or Processor Decision Tree For Data Processing Agreements

Why Is The Controller Or Processor Decision Important In The UK?

Choosing the correct role is essential because UK GDPR duties depend on whether an organisation is a controller, processor, joint controller, or an independent controller sharing data with another controller.

When Do You Need A UK Data Processing Agreement?

A UK data processing agreement is required where a processor processes personal data on behalf of a controller. The agreement must include the mandatory terms in UK GDPR Article 28, including documented instructions, confidentiality, security, sub-processors, assistance, deletion or return of data, and audit rights.

What Happens If You Use The Wrong Agreement?

Using a processor DPA for a controller-to-controller or joint controller relationship can leave key duties uncovered. The parties may fail to give proper privacy information, choose the wrong lawful basis, allocate data subject request responsibilities incorrectly, or overlook international transfer requirements.

How Does The ICO View Controller And Processor Roles?

The UK Information Commissioner's Office expects organisations to assess the real facts of the processing, not just the labels used in a contract. A contract saying that a party is a processor will not be conclusive if that party actually decides its own purposes for using personal data.

What Should UK Organisations Do Before Signing A DPA?

• Map the personal data, purposes, and processing activities.
• Identify who decides the purposes and essential means.
• Check whether any supplier acts only on documented instructions.
• Use an Article 28 DPA for controller-to-processor processing.
• Use a data sharing agreement for independent controller sharing where appropriate.
• Use an Article 26 arrangement for joint controllers.

For further guidance, see the ICO guidance on controllers and processors and UK GDPR Article 28.