Any supplier that handles personal data for you needs a written agreement, and that includes the AI services it uses. This form records what is processed, where, by whom and under what safeguards, with the processor's declaration built in.

Effective Form Templates

This form template is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Form number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested form templates. No junk, jargon or unnecessary content. Simple and usable form templates developed over 25 years through practical use in the real world.

Further Reading

Further guidance on data processing and suppliers:

• Data Protection and UK GDPR
• Supplier and Third-Party Information Security
• Cloud Computing Risks and Exit Strategies
• Legal and Compliance knowledge base

Logo Update Service

Download this form template with your company name and logo already added!
Document Preparation is included with the alphaZ subscription.

How to Download

This file is included in the alphaZ subscription. This form is also included in the GDPR / Data Protection Toolkit and the ISO 22458 toolkit and the integrated toolkits that include it, so the toolkit route gives you this file plus everything else you need in one download.

Need Help Implementing?

If you'd like hands-on help putting data processing agreements in place with your suppliers, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Data Transfer and Processing Agreement Template

A data transfer and processing agreement for putting a written contract in place with any organisation that processes personal data on your behalf. It records the processor's details and locations, the term of the agreement and its review date, the security measures in place, a summary of the personal data processed, any sub-processors, and a signed declaration from the processor.

What's Included in this Agreement

• General details - the requirement for a written contract and the terms that apply
• Data processor details - company name, all processing locations, the date the agreement is effective from, review date, term, and the technical and organisational security measures
• Summary of personal data transferred / processed - personal data and categories of data subject, processing and purpose, and duration held
• Sub-processors - each sub-processor, the service provided including any use of AI, and the processing location and transfer safeguard
• Processor declaration - commitments on lawful processing, security, sub-processors, breach notification and that personal data is not used to train an AI provider's models, signed and dated

Who Needs a Data Transfer and Processing Agreement?

Any organisation that uses a supplier to process personal data on its behalf - payroll, IT support, cloud software, marketing platforms, recruitment systems or AI services.

Included in the GDPR / Data Protection Toolkit

This form is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download, and is also included in the ISO 22458 toolkit.

Works with the Personal Data Register

Each processor and AI service provider should appear in the sharing and transfer details of your personal data register, such as the F-IMS24 Personal Data Register, so the register and the agreements tell the same story.

Using the Agreement

Complete one agreement for each processor. Enter the processor details and security measures, summarise the personal data processed and who it is about, list any sub-processors, and have the processor sign the declaration. Set the review date and keep the signed agreement with your supplier records.

AI Service Providers as Sub-processors

Many suppliers now build AI features into their services, using an AI provider behind the scenes. Those providers are sub-processors, so the agreement asks for each one to be named with the service provided, where the processing takes place and the transfer safeguard, and it includes a declaration that personal data is not used to train an AI provider's models.

Why a Written Agreement Matters

A written agreement sets out what the processor may and may not do with the personal data, and is one of the first things asked for when a supplier is reviewed or a breach occurs at a supplier.

Related Documents

Other documents in the GDPR / Data Protection Toolkit that work alongside this one:

• F-IMS24 Personal Data Register
• F-Q97 Data Protection Impact Assessment
• GG-8-06 Information Transfer