Free CRM for accountants & bookkeepersFree for two months (60-day trial) · no per-user fees
Template · Staff
Data Processing Agreement Template (Processor, UK GDPR Art 28) (Free Download)
Set out processor obligations before an outsourcing provider handles personal data.
Built by a practising Chartered Accountant · Unlimited users · 60-day free trial · Last updated 24 September 2026
Quick answer
General guidance, not legal advice. Take advice on your contracts and data transfers. This data processing agreement (DPA) template is a starting structure for where an outsourcing provider processes personal data on your firm's behalf as a processor, aligned to the requirements of UK GDPR Article 28. Have it reviewed and completed by a solicitor or data protection adviser before use.
Who is this sent to, and when?
- Sent to
- Outsourcing/offshore provider (processor)
- When to send it
- Before any personal data is shared with a provider acting as a processor
Why is a separate data processing agreement needed?
Under UK GDPR Article 28, where a processor handles personal data on your behalf, a written contract setting out specific processor obligations is required, not just a general commercial agreement. This applies to outsourcing and offshore providers who process client personal data as part of the services they deliver.
This sits alongside, not instead of, your main outsourcing agreement.
What if the provider is outside the UK?
If personal data is transferred to a provider outside the UK, you generally also need an appropriate transfer mechanism, such as the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, in addition to this DPA. [VERIFY] which mechanism applies to your specific transfer against current ICO guidance.
Points to check
- Where the provider and any sub-processors are actually located
- Whether the destination country has UK adequacy or needs a transfer mechanism
- Whether a transfer risk assessment has been completed
Preview the template
Template only. Review with a solicitor or your professional body before use.
Data Processing Agreement Template (Processor, UK GDPR Art 28) (Free Download)
Data Processing Agreement (Processor)
Between [Firm Name] ("Controller") and [Provider Name] ("Processor").
**1. Subject Matter and Duration**
The Processor will process personal data on behalf of the Controller for the purpose of [Insert Purpose, e.g. bookkeeping support services] for the duration of the outsourcing agreement dated [Insert Date].
**2. Nature and Purpose of Processing**
[Insert description of processing activities, categories of data, and categories of data subjects.]
**3. Processor Obligations (UK GDPR Article 28)**
The Processor will: (a) process personal data only on documented instructions from the Controller; (b) ensure staff are subject to confidentiality obligations; (c) implement appropriate technical and organisational security measures; (d) assist the Controller
Preview shows the opening and key sections. The full editable file is free to download below.
See it working with your own clients
A 30-minute walkthrough using your services, deadlines and templates.
Send this from Remindoo
Save it once in Remindoo and send it from there. Store the wording as an email template, then use tokens so client names, company numbers and dates fill in automatically. Send it to one client or to a filtered group with bulk client emails. For requests that repeat, pair it with automated reminders and a recurring task so it goes out every period without anyone remembering. For engagement letters and proposals, use proposals and letters of engagement with e-signatures.
What are the common mistakes?
- Relying on a general outsourcing agreement instead of a proper Article 28 DPA
- Not identifying every sub-processor the provider actually uses
- Overlooking the need for a separate international transfer mechanism
- Failing to keep evidence of the provider's security measures
“Managing deadlines and tasks is much easier.”
Frequently asked questions
Do I need this in addition to the outsourcing agreement?
Yes, where personal data is processed on your behalf, Article 28 requires specific processor terms, which are usually set out in a dedicated DPA.
What is the ICO IDTA?
The International Data Transfer Agreement is one of the ICO's approved mechanisms for transferring personal data outside the UK; the UK Addendum is an alternative used alongside the EU Standard Contractual Clauses. [VERIFY] which applies to your transfer.
Who is responsible if the provider has a data breach?
Responsibilities are usually shared and should be set out clearly in the DPA; take legal advice on how liability is allocated in your specific agreement.
Does this replace legal advice?
No. General guidance, not legal advice. Take advice on your contracts and data transfers.
Does Remindoo transfer or process client data on my behalf as described here?
This template relates to your arrangements with third-party outsourcing providers; check Remindoo's own terms and data processing documentation separately for how Remindoo itself handles data.
How often should the DPA be reviewed?
Review it whenever the scope of processing changes, a new sub-processor is added, or at least annually.
Ready to run a calmer practice?
See Remindoo with your own clients, or start free for 60 days with unlimited users.
Sources
Last updated 24 September 2026. General guidance, not regulatory advice.
Why recording every task matters in an accountancy practice
Accounting firms run on deadlines: VAT returns, payroll, confirmation statements, accounts and Self Assessment. Recording every job as a task, with an owner and a date, is the simplest way to make sure nothing is missed.
Avoid penalties
HMRC and Companies House charge penalties for late filing. A task for every deadline, with an internal date before it, gives the team a buffer.
Nothing depends on memory
Recorded tasks mean work continues when someone is off sick, on leave or has left the firm.
Consistent quality
Subtask checklists make every job follow the same steps and reviews, whoever does the work.
Visibility for managers
Filters by owner, status and deadline show at a glance what is late, what is due and who needs help.
Practical tips from UK practice
- Set an internal deadline two to four weeks before every statutory deadline.
- Use recurring tasks for repeat work such as VAT, payroll and bookkeeping.
- Break larger jobs into subtasks, including a review step.
- Comment on the task instead of by email, so the history stays with the work.
Related Remindoo features
Written and reviewed by Waqas Sagar ACA FCCA FMAAT, Chartered Accountant with 18+ years in practice. Founder and MD of Accotax, an ICAEW, ACCA and AAT regulated London practice that has served over 5,000 clients, and founder of Remindoo. Guidance is general; check current GOV.UK and professional body guidance for your firm.
What UK practices say about Remindoo
Read all reviews on Trustpilot“With Remindoo, everything from the first enquiry to onboarding and ongoing client management is tracked in one place… It saves us hours and gives me, as a practice owner, complete visibility of where the firm stands.”
“The biggest benefit is having clients, tasks, deadlines, workflows, proposals and communication all organised in one place.”
“During my trial, the team were absolutely amazing. They helped onboard my clients, set up my settings and made sure everything was ready for me to use… they made the whole process completely stress-free.”
“It brings client information, tasks, recurring deadlines, workflows and reminders together in one place, giving us much better visibility across the team.”
