Contract review
Review the core processor terms.
Article 28(3), alongside paragraphs (2) and (4). Open each topic to separate the legal requirement from a practical negotiation question. Owners are suggested, not assigned by the legislation.
Documented instructions
Article 28(3)(a)
Documented instructions
Article 28(3)(a)
Process only on documented instructions, including transfers, subject to the domestic-law exception.
Ask in the negotiation
Do service-improvement or AI-training terms permit uses beyond the controller’s instructions?
- Suggested owners
- Privacy · Legal
Confidentiality
Article 28(3)(b)
Confidentiality
Article 28(3)(b)
Authorised personnel must be bound by confidentiality commitments or an appropriate statutory duty.
Ask in the negotiation
Does this cover everyone the processor permits to access the personal data?
- Suggested owners
- Privacy · Security
Security measures
Article 28(3)(c)
Security measures
Article 28(3)(c)
Require the security measures mandated by Article 32.
Ask in the negotiation
Does the security schedule support the actual processing risk, and what evidence backs it?
- Suggested owners
- Security · Privacy
Subprocessor authorisation
Article 28(2), (3)(d), (4)
Subprocessor authorisation
Article 28(2), (3)(d), (4)
Prior written authorisation; change notice and objection for general authorisation; equivalent obligations and processor responsibility.
Ask in the negotiation
Can Privacy inspect the current list and assess a proposed change before it takes effect?
- Suggested owners
- Privacy · Third-Party Risk · Legal
Individual rights
Article 28(3)(e)
Individual rights
Article 28(3)(e)
Assist with rights requests through appropriate measures, considering the processing’s nature and what is possible.
Ask in the negotiation
Are the contact route, practical assistance and response timing usable by the controller?
- Suggested owners
- Privacy · Service owner
Security, breach and assessment assistance
Article 28(3)(f)
Security, breach and assessment assistance
Article 28(3)(f)
Assist with Articles 32–36, considering the processing and information available.
Ask in the negotiation
Can the controller obtain what it needs for incident response, impact assessments and consultation?
- Suggested owners
- Privacy · Security
Return or deletion
Article 28(3)(g)
Return or deletion
Article 28(3)(g)
At the controller’s choice, return or delete data and delete copies, except legally required retention.
Ask in the negotiation
Do backup, retention and exit schedules preserve the controller’s choice and explain residual copies?
- Suggested owners
- Privacy · Security · Legal
Information, audits and unlawful instructions
Article 28(3)(h)
Information, audits and unlawful instructions
Article 28(3)(h)
Provide compliance information, allow and contribute to audits, and flag instructions considered unlawful immediately.
Ask in the negotiation
Do assurance reports support the review without removing the required audit and information rights?
- Suggested owners
- Privacy · Legal · Security
Look beyond one clause
Review the connected conditions.
Do not copy the controller’s 72-hour deadline
Article 33(2) requires the processor to notify the controller without undue delay. The controller’s separate supervisory-notification rule is not a blanket 72-hour allowance for the processor. Set operational timing that supports the controller’s response.
UK GDPR Article 33(1)–(2)A DPA is not the whole transfer assessment
Identify whether the data flow is a restricted transfer and address the applicable transfer rules separately. Processor terms do not, by themselves, establish the required transfer basis.
ICO international-transfer guidanceCommercial terms must fit the required protections
Review audit restrictions, assistance costs and connected liability terms together. An organisation’s preferred fallback is not permission to remove a statutory obligation.
ICO: minimum required contract terms
DataHalt’s role
Make the authority operational.
Your team determines applicability and approves the policy. DataHalt connects that policy to the proposed vendor response, its evidence and the people who must decide.
Start with one vendor workflow. Agree the supplier facts, approved policy and evidence your teams need, then validate the decisions before live use.
Prepare the decision
Identify changed positions and assemble the connected agreement, third-party-risk context and evidence.
Evaluate the complete package
Check current policy, required evidence, package dependencies and functional decision rights. Route exceptions to their responsible owners.
Recheck before progression
Live vendor responses require human approval and a fresh check of current authority, exact content and destination. A permit or wording approval alone is not permission to send.
Sources and scope.
Official sources reviewed on 5 October 2026. Use the current legislation and applicable guidance when setting policy; this is a focused contracting overview, not an exhaustive regulatory checklist.
- UK GDPR — Article 28
The statutory processor requirements, including written terms and subprocessors.
- ICO — What needs to be included in the contract?
Explanatory contract guidance; currently marked under review following the Data (Use and Access) Act.
- UK GDPR — Article 33
Distinguishes the processor’s notification duty from the controller’s supervisory-notification duty.
- ICO — International transfers
Current guidance on restricted transfers, safeguards and transfer assessments.
This guide is general operational information, not legal advice or compliance certification. The customer retains responsibility for legal interpretation, risk classification and signing authority. DataHalt evaluates configured authority for supported actions; it does not replace the customer’s compliance programme or contract-lifecycle system.