Fixing Missing Data Processing Agreements With Suppliers
Almost every website hands personal data to other businesses: the hosting company, the email marketing platform, the form builder, the payment provider, the developer who looks after the site.
When one of them handles data on your behalf, Article 28 of the UK GDPR says you must have a written contract with specific terms, usually called a data processing agreement or DPA. Many small businesses have never looked. This guide shows how to find every supplier, decide which are processors, get or check the agreement, and keep a simple register so new tools do not slip through.
Before you start: this is not legal advice
This guide explains the contract requirements in the UK GDPR and a practical way for a small business to meet them. It is not legal advice. If a supplier refuses to sign a data processing agreement, offers terms that seem to let them use your customers' data for their own purposes, or you process sensitive data such as health information, get advice from a solicitor or data protection specialist. The ICO publishes guidance on contracts between controllers and processors, including a checklist of the required terms.
Controller, processor, or something else
The contract you need depends on the role each business plays. You are normally the controller for your customers' data: you decide why and how it is used. A processor handles the data only on your instructions and for your purposes. Only processor relationships need an Article 28 agreement.
| Role | What it means | Typical website examples | What you need |
|---|---|---|---|
| Processor | Acts only on your instructions, for your purposes. | Web hosting, email marketing platform, form builder, help desk, CRM, backup service, a freelance developer with database access. | An Article 28 data processing agreement. |
| Independent controller | Decides its own purposes for the data it receives. | Accountants and solicitors acting under professional duties, couriers for their own delivery records, payment providers for their own fraud and regulatory obligations. | No Article 28 agreement, but you need a lawful basis to share and should tell people in your privacy notice. |
| Joint controller | Decides the purposes together with you. | Some advertising and social media integrations, joint marketing campaigns with a partner. | An arrangement under Article 26 setting out who does what. |
One supplier can hold more than one role. A payment provider may be your processor for taking the payment and an independent controller for its own anti-fraud checks. Analytics and advertising providers often describe different roles for different features, so read their terms for the settings you actually use.
What the agreement must contain
Article 28(3) of the UK GDPR lists what the contract must include. Use this as a checklist against each supplier's agreement.
| Term | What to look for |
|---|---|
| Details of the processing | The subject matter, duration, nature and purpose, types of personal data and categories of people. Often in a schedule or annex. |
| Documented instructions | The processor acts only on your written instructions, including on transfers outside the UK. |
| Confidentiality | Staff who handle the data are bound by confidentiality. |
| Security | Appropriate technical and organisational measures under Article 32. |
| Sub-processors | No other processor used without your authorisation, with the same obligations passed down. |
| Help with rights requests | The processor helps you respond to people exercising their rights. |
| Help with security, breaches and assessments | Including telling you about a breach without undue delay and helping with impact assessments. |
| Deletion or return | At the end of the service, the data is deleted or returned, at your choice, unless the law requires it to be kept. |
| Audits and information | The processor gives you the information needed to show compliance and allows audits or inspections. |
The contract must be in writing, which includes electronic form. Clicking to accept a supplier's online DPA, or a DPA built into the terms you accepted when you signed up, counts, as long as you can find it and it contains these terms.
The fix, step by step
Step 1
Build a list of every supplier
Start with three sources. Open your site in a private window with the Network tab of the developer tools open and note every third-party domain that loads. Then go through the last twelve months of bank and card statements for subscriptions to online services. Finally, ask everyone in the business which tools they use for email, forms, files, bookings and chat, because free tools never show up on a statement.
Step 2
Decide each supplier’s role
For each supplier, note what personal data it receives, if any, and whether it uses the data only to provide a service to you or also for its own purposes. Mark each one as processor, independent controller, joint controller or no personal data. Check the supplier's own privacy and legal pages, which usually state the role they believe they play, and question it where their described use of the data seems broader than your instructions.
Step 3
Find or request the agreement
For each processor, look for the agreement in the account settings, billing or legal section of their dashboard, or on a trust or legal page often titled data processing addendum. Some apply automatically through their terms of service; others need you to accept or sign it separately. Download a copy with the date. For small suppliers and freelancers with no standard terms, send your own short agreement based on the ICO's checklist of required terms.
Step 4
Check the required terms are there
Read each agreement against the Article 28 list: processing details, documented instructions, confidentiality, security, sub-processors, help with rights requests and breaches, deletion or return, and audits. Large suppliers' agreements usually cover all of them. Pay attention to how quickly they must tell you about a breach and whether they claim any right to use your data for their own purposes. Note any gaps in your register and raise them with the supplier.
Step 5
Look at sub-processors and locations
Most agreements give general authorisation for the supplier to use its own sub-processors, such as cloud hosting, provided it tells you about changes and lets you object. Find the published sub-processor list, sign up for change notifications if offered, and note which countries the data goes to. Where data leaves the UK, check the agreement names a transfer safeguard such as the international data transfer agreement or addendum.
Step 6
Record it all in a supplier register
Keep one spreadsheet with a row per supplier: name, service, personal data involved, role, where the agreement is stored and its date, transfer safeguard, and the date of your last check. Link the register to your records of processing and make sure the privacy notice names the categories of recipients. Store copies of the agreements in a shared folder, not in one person's downloads.
Step 7
Build the check into buying new tools
Add a simple rule: before anyone connects a new plugin, script, app or service that will receive customer or staff data, they check the supplier's agreement and add a row to the register. Put a yearly reminder in the calendar to review the register, remove suppliers you no longer use, confirm their data has been deleted, and check for changes to sub-processors and terms.
A supplier register you can copy
A register does not need special software. The example below shows the columns that matter, for a fictional shop called Tallow and Wick Ltd.
Supplier Service Data Role DPA stored Transfers Checked
Web host Hosting, backups All site data Processor /legal/host-dpa.pdf UK only 2026-09
Email platform Newsletter Names, emails, opens Processor Accepted in dashboard US, UK addendum 2026-09
Form builder Contact forms Names, emails, messages Processor /legal/forms-dpa.pdf EU 2026-09
Payment provider Card payments Payment and order details Processor and controller Terms, section 14 Various 2026-09
Freelance developer Site maintenance Database access Processor Signed 2026-06-02 UK 2026-09
Accountant Year-end accounts Invoices, customer names Controller Not required UK 2026-09
Web fonts Font files IP address when loaded Check Consider self-hosting Various 2026-09The last row shows why the register is useful. Some third-party services receive visitors' IP addresses simply because the browser requests a file from them. Self-hosting such files can remove the supplier from the list entirely, which is often simpler than managing the relationship.
Freelancers, agencies and small suppliers
Large platforms publish standard agreements. The gaps are usually with small suppliers: a freelance developer with admin access, a virtual assistant managing the inbox, a marketing agency running ads from your customer list, or a local IT support firm. Where they handle personal data for you, they are processors too, and the same Article 28 terms apply.
A short agreement is enough, as long as it covers the required terms. It helps to add practical details:
- Which systems they may access and with which account, ideally their own login rather than a shared password.
- That they do not download or copy customer data to their own devices unless needed, and delete any copies when the job is done.
- How to contact you straight away if they suspect a breach, and that the breach response plan names them.
- That their access is removed when the work ends, and who is responsible for doing that.
If you are the supplier, for example a web developer who looks after client sites, the roles reverse: your clients need an agreement from you. The B2B SaaS guide covers the processor side in more detail.
Keeping contracts current
- Watch for terms updates. Suppliers change their DPAs and sub-processor lists. Keep the notification emails and file them with the register.
- Remove leavers. When you stop using a tool, delete your account data, ask for confirmation, and mark the row as closed rather than deleting it.
- Keep the privacy notice aligned. Each new category of supplier, such as a first chat widget or review platform, may need a line in the notice.
- Ask before plugging in. Many content management system plugins send data to their developer's servers for licensing, spam checks or features. Check before installing.
For the wider picture, see the GDPR Guide and the example audit.
1. What is a data processing agreement?
It is the written contract Article 28 of the UK GDPR requires between a controller and a processor, meaning a business that handles personal data only on the controller's instructions. It sets out what data is processed and why, and commits the processor to act only on instructions, keep the data secure and confidential, control its own sub-processors, help with rights requests and breaches, delete or return data at the end, and allow audits.
2. Do I need a DPA with Google, Mailchimp or my web host?
If a supplier processes personal data on your behalf, such as storing your subscribers, customers or form entries, you need an agreement with the Article 28 terms. Large providers usually publish one, either built into their terms of service or as a separate addendum you accept in the account settings. Find it, check it covers the services you use, save a dated copy and add it to your supplier register.
3. Is my accountant a data processor?
Usually not. Accountants and solicitors generally act as controllers for the data they receive, because their professional and legal duties decide how they use it rather than your instructions. That means an Article 28 agreement is not normally required, although you still need a lawful basis to share the data and should mention the category of recipient in your privacy notice. A bookkeeper who simply processes records on your instructions may be a processor.
4. Does a freelance web developer need to sign a DPA?
If they can access personal data, for example through the site's admin area, database, hosting account or backups, they are acting as your processor and you need a written agreement with the Article 28 terms. It can be short. Add practical points such as using their own login, not keeping copies of data, telling you immediately about any suspected breach, and removing access when the work finishes. Keep the signed copy with your supplier register.
5. Is clicking accept on a supplier's online DPA enough?
Yes, in most cases. The UK GDPR requires the contract to be in writing, and electronic form counts. Accepting a published data processing addendum in a dashboard, or agreeing to terms of service that include one, meets the requirement if the terms cover everything Article 28 lists. Keep evidence of acceptance, such as a dated download or confirmation email, because the supplier's page may change later and you may need to show which version applied.
6. What is a sub-processor?
A sub-processor is a business your processor uses to help provide its service and which also handles your data, such as the cloud platform your email provider runs on. Your processor needs your authorisation to use them, usually given generally in the agreement with a right to be told about changes and to object. The processor must pass on the same data protection obligations and remains responsible to you for them.
7. What if a supplier will not provide a DPA?
Ask again in writing, explaining that Article 28 requires one. Some small suppliers simply do not know and will sign a short agreement you provide. If a supplier that clearly processes personal data for you still refuses, you have a compliance gap that you cannot fix on your own, and the practical options are to limit the data they receive or move to a supplier that offers proper terms. Record the decision in your register.
The GDPR Audit checks what a visitor can see, including the scripts that load before consent, the cookie banner, the privacy policy and the routes people have to exercise their rights, and links each finding to its fix.
Open GDPR Fixes →