Accountio / Templates / UK GDPR / Data processing agreement checklist

Data processing agreement checklist for accountancy practices

Before client or payroll data goes into a new system, check that the supplier's terms give you everything Article 28 of the UK GDPR requires, and note where each point sits in their contract. This data processing agreement checklist is one Word form you fill in for each supplier.

UK practices
$15
In the pack
UK GDPR pack for practices
Files
10, Word and Excel
Buy the pack · $15
Global library · 101 packs

Get this pack and 100 more for $129

UK GDPR for practices · this packAML complianceCharity accountsEstate administrationMTD for Income TaxP11D and payrollingUK SRS readinessCarbon reduction planCIS+ 92 more
$129$1,42191% off

You save $1,292 on buying them one by one

Buy the global library · $129

What the checklist looks like

Data processing agreement checklist template
What the checklist coversSection in the checklist
Which supplier you checked, and when
✓
Supplier, Service, Checked byThe supplier, what they do for you, and the name and date of the person who checked
Working only on your instructions
✓
The contract must say the supplier willOnly use the information on your documented instructions
Confidentiality and security
✓
The contract must say the supplier willStaff keep the information confidential, and the supplier keeps it secure
Sub-processors
✓
The contract must say the supplier willOther suppliers only with your permission, on the same terms
Help with rights, breaches and risk assessments
✓
The contract must say the supplier willSupport when people exercise their rights, and with security, breaches and risk assessments
The end of the service
✓
The contract must say the supplier willDelete or return the information
Audits
✓
The contract must say the supplier willGive you the information you need to show compliance, and allow audits
What is processed, why and for how long
✓
The contract must say the supplier willThe description of the processing the contract has to contain
Where each point is in their terms
✓
Covered?, Where in their termsYes or No for each line, with the clause you found it in
Where the data is stored
✓
Other checksAnd the safeguard that applies if it is outside the UK
AI training, sign-in and breach notice
✓
Other checksWhether your data trains AI models, multi-factor sign-in, and how quickly they tell you about a breach
Security certification
✓
Other checksSuch as an ISO security certification or Cyber Essentials
Your decision
✓
DecisionApproved, approved with changes or not approved, with notes

When you need it

Under the UK GDPR, your firm can only use suppliers that can show they will protect personal information properly, and the contract with each one must be in writing. Most software suppliers publish a data processing agreement. Check it against the list and keep a copy when:

  • You start using new accounting, payroll, practice management, cloud storage, email or identity check software
  • You review the suppliers you already use, as part of your yearly data protection review
  • A supplier changes its terms or tells you about a new sub-processor
  • A client or your professional body asks how you check the software that holds their data

How to use the data processing agreement checklist

  1. List your suppliers. Take every supplier that handles personal information for you from your record of processing.
  2. Get each supplier's agreement. Download their data processing agreement or the data protection section of their terms.
  3. Work down the contract table. Mark each line Yes or No and write the clause number where you found it.
  4. Answer the other checks. Storage location, AI training, multi-factor sign-in, breach notice and certification.
  5. Record a decision. Approve, approve once a setting is changed, or choose another supplier. File the checklist with a copy of their terms.

Questions

What is a data processing agreement?

The contract between your firm, as controller, and a supplier that handles personal information for you, as processor. Article 28 of the UK GDPR requires one, and it must be in writing, which includes electronic form.

What must a data processing agreement include?

The subject matter and length of the processing, its nature and purpose, the type of personal data, the types of people it relates to, and your obligations and rights. It must also commit the supplier to act only on your documented instructions, keep staff bound by confidentiality, keep the data secure, use sub-processors only with your authorisation, help you with people's rights and with security, breaches and risk assessments, delete or return the data at the end, and give you the information you need to show compliance, including audits.

Do accountants need a data processing agreement with their software providers?

Yes, with every provider that handles personal information on your behalf, such as your accounting, payroll, practice management and cloud storage software. The law only lets you use processors that can show they will protect the data with the right technical and organisational measures.

Can a supplier use sub-processors?

Only with your prior written authorisation, either for a named sub-processor or as a general authorisation. Under a general authorisation, the supplier must tell you about any planned change so you can object.

How quickly must a supplier tell you about a data breach?

Without undue delay after it becomes aware of the breach. Your own 72 hours to report to the ICO starts when you become aware, so the checklist asks each supplier how quickly it will tell you.

Also in the UK GDPR pack for practices

Record of processing activitiesData protection policyAppropriate policy documentRetention scheduleData breach procedureData protection logsSubject access request procedureData protection complaints procedureStaff privacy notice

See the whole pack →

Who it's for

Accountancy practices that keep client, payroll and anti-money laundering records in cloud software.

Last checked

Checked against Articles 28 and 33 of the UK GDPR on legislation.gov.uk in November 2026.