Our standard UK GDPR Article 28 agreement for law firms and chambers, so you can review the terms before we start work.
Last updated: 4 November 2026
This Data Processing Agreement (the DPA) is made on [date] (the Effective Date) between:
Background
1.1 In this DPA, the following terms have the meanings below. Terms such as controller, processor, data subject, personal data, personal data breach, processing and special category data have the meanings given in the UK GDPR.
1.2 References to legislation include that legislation as amended or replaced. Headings do not affect interpretation. The Schedules form part of this DPA.
2.1 The Controller is the controller and the Processor is the processor of the Controller Personal Data. The details of the processing are in Schedule 1.
2.2 The Processor will process Controller Personal Data only on the Controller’s documented instructions. The Services Agreement, this DPA and any further written instructions the Controller gives (including by email) are the Controller’s documented instructions.
2.3 The Processor will not process Controller Personal Data for its own purposes, and will not sell it, share it with others for marketing, or combine it with personal data from any other source.
2.4 If the Processor believes an instruction infringes data protection law, it will tell the Controller promptly and may pause that part of the work until the Controller confirms or changes the instruction.
2.5 The Controller confirms that it has a lawful basis to give the Controller Personal Data to the Processor, and that it has given data subjects any notices that the law requires. The Controller remains responsible for its own compliance with data protection law and with its regulatory duties, including those owed to its clients.
3.1 The Processor will:
3.2 These obligations are intended to meet the requirements of Article 28(3) of the UK GDPR.
4.1 The Processor will put in place technical and organisational measures that are appropriate to the risk, including those in Schedule 2. It will keep them up to date and will not make them materially weaker during the term.
4.2 The Processor will treat all Controller Personal Data, and all other information it sees through the Services, as confidential. This duty continues after this DPA ends.
4.3 The Processor understands that the Controller is a legal practice or chambers and that some material may be subject to legal professional privilege. The Processor will not do anything that would knowingly waive that privilege, and will tell the Controller at once if it believes privileged material has been disclosed by mistake.
4.4 The Controller will not send privileged or highly sensitive client material through the Processor’s website forms or by ordinary email. Such material should be shared only through the Controller’s own systems, as set out in Schedule 2.
5.1 The Controller gives general authorisation for the Processor to use the Sub-processors listed in Schedule 3.
5.2 The Processor will tell the Controller in writing before adding or replacing a Sub-processor, giving at least [14] days’ notice. The Controller may object on reasonable data protection grounds within that time. If the parties cannot resolve the objection, the Controller may end the affected Services without penalty.
5.3 The Processor will have a written contract with each Sub-processor that puts on it data protection obligations no less protective than those in this DPA.
5.4 The Processor stays fully responsible to the Controller for what its Sub-processors do or fail to do.
6.1 The Processor is based in Pakistan, which is not covered by UK adequacy regulations. The parties therefore agree that Controller Personal Data will be transferred to the Processor only under the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, signed by both parties and attached to or referred to in this DPA.
6.2 The Processor will not transfer Controller Personal Data to any other country, or allow access to it from another country, unless the Controller has agreed in writing and a lawful transfer mechanism is in place.
6.3 The Processor will give the Controller the information it reasonably needs to carry out and keep up to date a transfer risk assessment, including information about the laws and practices that may affect the Processor’s ability to follow this DPA.
6.4 If the Processor can no longer meet its obligations under the transfer mechanism, it will tell the Controller promptly. The Controller may then suspend transfers and, if the problem is not fixed, end the affected Services.
7.1 The Processor will tell the Controller without undue delay, and in any case within [24] hours, after becoming aware of a Personal Data Breach affecting Controller Personal Data. The notice will go to the Controller’s contact in Schedule 1.
7.2 The notice will include, as far as it is known at the time: what happened; the categories and approximate number of data subjects and records affected; the likely consequences; and the steps taken or proposed to deal with it. The Processor will send further details as they become available.
7.3 The Processor will act quickly to contain and fix the breach and will cooperate with the Controller’s investigation.
7.4 The Controller decides whether to notify the ICO or data subjects. The Processor will not notify them, or make public statements naming the Controller, unless the law requires it or the Controller agrees.
8.1 If a data subject contacts the Processor about Controller Personal Data, the Processor will pass the request to the Controller promptly and will not respond unless the Controller asks it to. The Processor will give reasonable help so the Controller can answer requests to exercise rights under the UK GDPR.
8.2 The Processor will give reasonable help with data protection impact assessments, consultations with the ICO and the Controller’s security obligations, taking into account the nature of the processing and the information available to the Processor.
8.3 The Processor will keep records of its processing for the Controller as Article 30(2) requires, and will make available the information needed to show compliance with this DPA.
8.4 The Controller may audit the Processor’s compliance with this DPA, or appoint an independent auditor bound by confidentiality to do so. Audits will be no more than once a year (unless a breach or a regulator requires otherwise), on at least [14] days’ written notice, during normal working hours, and without unreasonable disruption to the Processor’s business.
8.5 Each party bears its own costs of audits and assistance unless the Services Agreement says otherwise. The Processor may charge reasonable costs for help that goes beyond what is normally needed to comply with data protection law, if it has agreed the charge with the Controller in advance.
9.1 Return and deletion. When the Services end, or earlier if the Controller asks, the Processor will within [30] days delete or return all Controller Personal Data, as the Controller chooses, and delete existing copies, unless the law requires the Processor to keep some of it. The Processor will confirm in writing that this has been done. Where the Processor works only inside the Controller’s own systems, the Controller will remove the Processor’s access on the same date.
9.2 Liability. Each party’s liability under this DPA is governed by the limitations and exclusions in the Services Agreement. Nothing in this DPA limits liability that cannot be limited by law, or a data subject’s rights against either party.
9.3 Term. This DPA starts on the Effective Date and continues for as long as the Processor processes Controller Personal Data. Clauses that are meant to continue (including confidentiality, deletion and liability) survive its end.
9.4 Changes. Changes to this DPA must be in writing and signed by both parties, except that either party may propose reasonable changes needed to comply with changes in data protection law, and the parties will negotiate them in good faith.
9.5 Precedence. If this DPA conflicts with the Services Agreement on the processing of personal data, this DPA applies. If it conflicts with the IDTA or UK Addendum, the IDTA or UK Addendum applies.
9.6 Governing law and jurisdiction. This DPA, and any dispute arising from it, is governed by the law of England and Wales. The courts of England and Wales have exclusive jurisdiction, except that the IDTA or UK Addendum may provide otherwise for matters under it.
| Item | Detail |
|---|---|
| Subject matter | Administrative support services for the Controller under the Services Agreement |
| Duration | The term of the Services Agreement, plus the deletion period in clause 9.1 |
| Nature of processing | Accessing, viewing, organising, typing, editing, filing, storing, and deleting data as part of administrative work (for example document handling, diary and email management, data entry, case file preparation, billing support) |
| Purpose | To provide the Services to the Controller, on the Controller’s instructions |
| Types of personal data | Names, contact details, case or matter references, correspondence, documents and notes on a matter, diary entries, billing and payment details, and other data in the files the Controller gives access to [Controller to review and amend] |
| Special category / criminal offence data | [None expected / Possible, such as in some case files – Controller to confirm]. If included, the Controller will tell the Processor in advance |
| Data subjects | The Controller’s clients and their opponents, witnesses, staff, counsel, experts and other individuals named in the Controller’s files |
| Controller contact for notices | [Name, role, email, phone] |
| Processor contact for notices | Israr Khokhar, LegalDesk Partners, hello@legaldeskpartners.com |
The Processor will apply at least these measures:
| Sub-processor | Service | Location of processing |
|---|---|---|
| [Name – Processor to complete] | [Service] | [Country] |
| [Name – Processor to complete] | [Service] | [Country] |
If the Processor uses no Sub-processors, this schedule states “None”.
Signed by the authorised representatives of the parties on the Effective Date.
| Controller | Processor | |
|---|---|---|
| Company | [Law firm / chambers name] | LegalDesk Partners |
| Name | Israr Khokhar | |
| Title | Owner | |
| Signature | ||
| Date |