This Practice Note introduces the detailed data protection Negotiation Guide (the Guide) on the negotiation of provisions in agreements between controllers and processors that are subject to the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). Note that there are significant similarities between the UK GDPR and the EU’s General Data Protection Regulation, Regulation (EU) 2016/679 (EU GDPR) and this Practice Note focuses on the position under the UK GDPR. For information about the background to the UK GDPR and its relationship with the EU GDPR, see Practice Note: The UK General Data Protection Regulation (UK GDPR)—Summary of key legislation. For further information on the EU GDPR, see Practice Note: The EU’s General Data Protection Regulation (EU GDPR).

The Guide is detailed and assumes a level of knowledge of general data protection law. For a more general introduction to the requirements that apply where a controller uses a processor, and guidance on the meaning of key terms such as ‘controller’ and ‘processor’, see Practice Note: Supply chains under data protection law—arrangements