1. Draft schedule and roles
Before processing begins, complete the controller and processor legal entities, subject matter, duration, nature and purpose of processing, data types, data-subject categories, locations, subprocessors, transfer mechanisms, retention and security measures. Email support may involve staff/customer contact details, message metadata, message content and security logs; the agreed scope must specify what is actually necessary. Do not assume special-category data is authorised merely because it may exist in a mailbox.
2. Instructions and confidentiality
The processor will process personal data only on the controller’s documented lawful instructions, including transfers, unless law requires otherwise; in that case it will inform the controller before processing unless prohibited. It will immediately inform the controller if it considers an instruction infringes applicable data-protection law. People authorised to process data must be bound by confidentiality.
3. Security measures
The parties will document appropriate technical and organisational measures before access: least-privilege named accounts, MFA where supported, approved secure transfer, device/access controls, logging, access review, evidence minimisation, agreed retention and secure deletion. The processor will implement the agreed measures and assist the controller with its applicable security obligations. The completed security schedule must describe the actual service, not a generic certification claim.
4. Subprocessors and transfers
The processor will obtain the controller’s prior specific or general written authorisation for subprocessors. Under general authorisation it will notify proposed changes and allow the agreed opportunity to object. Equivalent data-protection obligations will be imposed in writing and the processor remains responsible for its subprocessor’s obligations. International transfers require documented instructions and a lawful mechanism; locations and safeguards must be recorded before use.
5. Requests, incidents and assistance
The processor will assist, taking account of the processing and information available, with data-subject requests, security, breach assessment/notification, impact assessments and prior consultation. It will notify the controller of a personal-data breach without undue delay after becoming aware, provide available relevant information and cooperate in response. The controller decides its regulatory and data-subject notifications unless law requires otherwise; incident contacts and secure reporting routes must be completed.
6. Return, deletion and audit
At the controller’s choice the processor will return or delete personal data after the service and delete copies unless law requires retention. The schedule records deadlines, backup handling and any lawful exceptions. The processor will make compliance information available and allow and contribute to audits, including inspections by the controller or its appointed auditor, with reasonable security arrangements that do not defeat those rights.
7. Completion and legal review
These clauses are a proposed UK controller–processor framework informed by ICO contract guidance, not a completed processing schedule or assurance of compliance. Confirm current law and the ICO’s updated guidance before signature, including any changes following the Data (Use and Access) Act. Supplier/controller identities, security measures, subprocessors, data locations and retention are still to be agreed.
The complete agreement
The selected service schedule, business service terms, data-processing agreement where applicable and completed signed order form the engagement. See how we work with your IT team.
All service agreements · Build your service
Reference: ICO controller–processor contract guidance, checked 18 October 2026. Guidance is under review following legislative changes. Also see processor responsibilities and the ICO contracts checklist.