Clause by Clause: Treating Processor Contracts as Live Governance Controls

Processor contracts are often filed at signature and revisited only at renewal. That is a governance gap. Under UK GDPR, the Article 28 contract is one of the main mechanisms through which a controller demonstrates control over personal data processed by another organisation. It is not procurement paperwork; it is a live control that must be reviewed when the service changes, when sub-processors change and when a regulator asks for evidence.

For a data governance committee, the practical question is not whether a contract exists. It is whether the clauses still describe the processing, whether the controller can exercise its rights and whether the evidence would survive scrutiny.

Why the committee should own the review

Procurement can negotiate commercial terms. Legal can advise on wording. Neither function necessarily sees the operational drift that makes a clause ineffective: a new sub-processor added without notice, a support model moved offshore, a breach notification route that no longer reaches the right team, or audit rights that are technically present but practically unusable.

The governance committee is the right forum because it can connect the contract to the record of processing activities, the transfer risk assessment, the incident process and the assurance plan. The review should be risk-based: priority processors first, then those with access to special category data, high volumes, critical services or international transfers.

A clause-by-clause review

The following questions are designed for a committee paper rather than a legal opinion. Each answer should be evidenced by a contract reference and an owner.

Article 28 obligations

Does the contract set out the subject matter, duration, nature and purpose of processing, the type of personal data and categories of data subjects? Does it impose the required obligations on the processor, including confidentiality, security, assistance with data subject rights and assistance with breach obligations? Are the instructions mechanism and the consequences of unauthorised processing clear?

Sub-processor changes

Is there prior authorisation or general authorisation with notification? If general authorisation is used, can the controller object, and within what period? Does the processor flow down equivalent obligations? Can the controller obtain a current sub-processor list without asking for a commercial amendment?

Audit rights

Does the controller have a right to audit, or to appoint an auditor? Is the right subject to reasonable notice and confidentiality? Can the controller rely on third-party certifications instead, and if so, which ones and for what scope? An audit right that cannot be exercised in practice is weak evidence.

Breach notification

Does the processor notify the controller without undue delay? Is there a named route and a maximum initial notification window? Does the notification include the information the controller needs to assess risk and meet its own 72-hour obligation? Has the route been tested in the last twelve months?

International transfers

Where data leaves the UK, is there a valid transfer mechanism, such as the UK International Data Transfer Agreement or the UK Addendum? Has a transfer risk assessment been completed? Does the contract identify the destination countries and any onward transfer restrictions? Does the sub-processor list match the transfer assessment?

Return and deletion

Does the contract require return or deletion at the end of the service, with a choice for the controller? Is there evidence of deletion from backups and sub-processors? Is the timescale realistic and recorded?

Case study: the handover that looked complete

A UK organisation replaced a customer engagement platform. The exit plan was signed off, the old contract was closed and the new contract was filed. Six months later, a data subject request exposed that a former sub-processor was still hosting archived campaign data. The old contract had permitted deletion on expiry, but no deletion certificate had been requested. The new contract contained audit rights, but the notice period made them unusable during the transition. The breach notification contact was a named individual who had left the business.

The failure was not a missing clause. It was a missing control. No one owned the handover evidence, no one tested the notification route and no one compared the sub-processor list to the transfer assessment. The committee had approved the contract but not the operating assumptions behind it.

Questions before renewal

A renewal is a natural checkpoint, but it should not be the only one. Before renewal, the committee should ask:

• Which business service and which record categories depend on this processor?
• Has the sub-processor list changed since signature, and was the change assessed?
• Has the breach notification route been tested, and who receives the first call?
• Can we exercise audit rights in the next twelve months, and what evidence will we accept instead?
• Does the transfer assessment still match the countries and onward transfers in the contract?
• What deletion evidence will we require at exit, and who will chase it?
• Which exceptions are we accepting, and for how long?

Regulatory briefing: evidence over assurance

UK accountability expectations are practical. A controller should be able to show that processor obligations were assessed, that risks were recorded and that the arrangement is monitored. A signed contract with no operating evidence is assurance without proof.

The committee paper should therefore be short but specific: the processor, the service, the data, the risk rating, the clause exceptions, the owner and the next review date. That is a more useful control than another statement that contracts are in place. Contracts become controls only when someone is accountable for their live operation.