Data processing agreement
Where GPDQ processes personal data on a client's behalf, the law requires a written agreement setting out what we do and on whose instructions. These are the standard terms we offer. They are incorporated into a client agreement by reference, and a client agreement may add to them but may not reduce the obligations that Article 28 of the UK GDPR requires.
1. What this agreement covers
This agreement applies wherever GPDQ Limited, company number 09635612 (the processor), processes personal data on behalf of a client (the controller) in the course of providing services under a client agreement. It gives effect to Article 28 of the UK General Data Protection Regulation. Whether GPDQ acts as processor or as controller for a given service is agreed in writing in the client agreement before the service starts; where GPDQ is the controller, our privacy notice applies instead.
2. The processing
The subject matter and duration of the processing, its nature and purpose, the types of personal data, the categories of data subject, and the controller's obligations and rights are set out in a processing schedule to the client agreement, which is completed before processing starts. For a clinical service the data will ordinarily be the identity and contact details of the people receiving care and their clinical information, which is special category data, together with the identity of the client's staff who administer the service.
3. Our obligations
We process personal data only on the client's documented instructions, including any transfer outside the United Kingdom, unless UK law requires us to do otherwise, in which case we tell the client of that requirement before processing unless the law prohibits us from doing so on important grounds of public interest. We tell the client at once if we believe an instruction breaks data protection law.
We make sure that everyone we authorise to process the data is bound by a duty of confidentiality, whether under contract or, for our clinicians, by their professional obligations as well.
We implement the technical and organisational measures Article 32 requires, appropriate to the risk, and we set out the measures that apply to a service in the processing schedule before processing starts. We are implementing an information security management system for certification to ISO/IEC 27001:2022, and its policies were issued in September 2026.
Taking into account the nature of the processing, we assist the client by appropriate technical and organisational measures, insofar as this is possible, in responding to people exercising their rights, and we route any request we receive to the client within 5 working days. Taking into account the nature of the processing and the information available to us, we assist the client in meeting its obligations on security, on notifying breaches, on data protection impact assessments and on prior consultation with the Information Commissioner.
We tell the client without undue delay after becoming aware of a personal data breach affecting the client's data, and in any event within 48 hours, and we give the client the information it needs to meet its own reporting duties.
At the end of the services we delete or return the personal data as the client chooses, and delete the copies we hold, unless UK law requires us to retain a record, in which case we tell the client which law and what we keep.
We make available to the client all the information needed to show that we meet these obligations, and we allow and contribute to audits and inspections by the client or an auditor it appoints, on reasonable notice and at reasonable intervals, and at any time a breach, a regulator or a credible concern makes one necessary.
4. Sub-processors
The client gives its general written authorisation for us to use sub-processors, and the current list is set out in the processing schedule. Those in general use across our services provide email and documents, web hosting, customer records, clinical records, forms, workforce scheduling and compliance, and email delivery. We tell the client before adding or replacing a sub-processor and give it the opportunity to object. We impose the same data protection obligations on every sub-processor by written contract, and we remain fully responsible to the client for its performance.
5. International transfers
Our clinical and workforce systems are hosted in the United Kingdom. Where a sub-processor holds data outside the United Kingdom, the transfer is made under the UK's adequacy regulations or under the international data transfer addendum to the standard contractual clauses, the processing schedule says which, and a copy of the safeguards is available to the client on request.
6. The client's obligations
The client is responsible for the lawfulness of the processing it instructs, for having a lawful basis and, for special category data, a condition for it, for giving the people concerned the information the law requires, and for the accuracy of the data it provides.
7. Liability and term
Liability under this agreement is governed by the liability clause of the client agreement. This agreement lasts as long as we process personal data for the client, and the obligations of confidentiality and deletion survive its end.
8. Agreeing it
This agreement is incorporated into a client agreement by reference to this page and the date shown below, or by a signed copy. Where a client prefers its own form of processing terms, we will review it. Where the two conflict, the signed document governs, except that nothing in either can reduce what Article 28 requires.
Version of 17 September 2026.