Do HR Consultants Need A Data Processing Agreement?

Priya runs a small HR consultancy in Manchester. A new client asks her to review sickness absence records, update contracts and advise on a grievance. Within a week, Priya has names, home addresses, salary details, health information and notes about workplace issues sitting in her HR platform.

That's normal HR work, but it's also sensitive data handling. If your client asks what GDPR terms you have in place, you don't want to be working it out after the files have already been shared.

A clear data processing agreement helps everyone know who is responsible for what, what you can do with employee data, how you'll keep it secure and what happens if something goes wrong.

Do HR Consultants Need A Data Processing Agreement?

Yes, you'll usually need a data processing agreement if you handle personal data for a client as part of your HR services.

Under the UK GDPR and the Data Protection Act 2018, a written contract is required where one business acts as a processor for another business. In many HR consultancy arrangements, your client decides why employee data is used and what outcomes they need. You then process that data to deliver the HR service.

For example, your client may ask you to:

• review employee files before a restructure
• prepare letters for a disciplinary process
• maintain absence records in an HR system
• support onboarding and right to work checks
• manage performance review documents
• advise on workplace complaints or grievances

In those situations, your client is often the controller and you're often the processor. That means you need data processing terms covering the points required by Article 28 of the UK GDPR.

Your data processing agreement can sit inside your HR services client contract or be a separate data processing schedule attached to it. Either way, it should be signed or agreed before you start receiving employee records.

Without clear terms, you may end up with awkward gaps. For example, your client might expect you to delete files after the project ends, while you need to keep a limited record for professional and business reasons. A good agreement deals with those details early, before they turn into a dispute.

Are You A Controller Or Processor For HR Services?

It depends on who decides the purpose and means of the processing, but many outsourced HR consultants are processors for at least part of the work.

The labels matter because they affect your legal duties, your contract terms and how you respond if there's a data breach or a subject access request.

When You Are Usually A Processor

You're more likely to be a processor where your client gives you employee data and instructions, and you use that data only to provide the agreed HR support.

For example, you might be a processor if your client says:

• please draft a disciplinary invitation letter using these notes
• please upload our staff records into this HR system
• please prepare an absence report for our management team
• please help us run this redundancy consultation process

Here, your client is deciding why the employee data is being used. You're helping carry out the task.

When You Might Be A Controller

You may be a controller for some processing if you decide your own purposes for using personal data.

For example, you may be a controller when you:

• keep your own client contact records for billing and account management
• manage your own marketing list
• keep business records about advice you have provided
• use data for your own legal compliance or insurance purposes

Sometimes you can be a processor for one part of the relationship and a controller for another. That's why role clarity is so useful. Your HR services contract should say which role applies to which processing activity, instead of using one label for everything.

What Data Processing Terms Does UK GDPR Require?

The UK GDPR requires processor contracts to include specific terms, so a simple confidentiality clause isn't enough.

Your agreement should set out the basics of the processing, then deal with the processor obligations required by Article 28. This doesn't have to be written in intimidating language. It just needs to be clear.

Your data processing terms should usually cover:

• Subject matter: what the processing is about, such as HR consultancy, employee relations support or HR administration.
• Duration: how long you'll process the data, including what happens after the project or retainer ends.
• Nature and purpose: what you'll do with the data and why, such as reviewing records, preparing documents or operating an HR platform.
• Types of personal data: names, contact details, job titles, salary, performance records, absence records and similar information.
• Categories of individuals: employees, workers, job applicants, contractors, managers and former staff.
• Client instructions: a promise that you'll process personal data only on your client's documented instructions, unless the law requires otherwise.
• Confidentiality: a requirement that your staff, contractors or associates keep the data confidential.
• Security measures: the practical safeguards you'll use to protect the data.
• Sub-processors: when you can use other providers, such as cloud storage, HR software or IT support.
• Assistance: how you'll help your client respond to data subject rights requests, security incidents and compliance checks.
• Deletion or return: what happens to personal data at the end of the services.
• Audit and information rights: how you'll show your client that you're meeting your obligations.

If you work with larger clients, they may send you their own processor agreement. Read it carefully before signing. Some client templates push too much risk onto you, such as unlimited liability for any data issue, even if the client caused the problem.

What Employee Data Needs Extra Care?

Employee data needs extra care because HR files often include sensitive information, not just names and email addresses.

In HR work, you may handle special category data under the UK GDPR. This can include health information, disability information, trade union membership, racial or ethnic origin, religious beliefs, sexual orientation and biometric data in some workplace systems.

You may also come across criminal offence data, especially where your work involves DBS checks or safeguarding processes. This has its own additional rules under the Data Protection Act 2018.

Your agreement should name the kinds of higher-risk data you expect to handle, including any health data sharing arrangements. It should also set boundaries around what your client should send you.

For example, your agreement might say the client should only share information that's relevant to the HR task. If you're helping draft a sickness absence letter, you may need dates of absence and adjustments being considered. You probably don't need a full medical history unless it's genuinely relevant.

That practical boundary helps both sides. Your client reduces unnecessary data sharing, and you reduce the amount of sensitive information sitting in your systems.

For higher-risk HR work, you may also want extra protections, such as:

• restricted access to files on a need-to-know basis
• multi-factor authentication for HR systems
• clear naming and storage rules for employee files
• password protection or secure portals for file transfer
• limits on downloading files to personal devices
• a process for redacting information that isn't needed

These details make your GDPR terms more practical. They also show clients that you have thought about the reality of HR consultancy work.

How Should Client Instructions And Security Measures Work?

Your client instructions and security measures should be specific enough that both sides know what is allowed day to day.

A common problem in HR consulting is that instructions arrive informally. Your client might send a message saying, please speak to this employee, or can you check these absence notes. That can be fine, but your agreement should explain what counts as an instruction and what happens if the instruction creates a data protection concern.

Your agreement can say that instructions may be given through agreed channels, such as email from named client contacts, your project management tool or the HR platform. It should also let you pause and query an instruction if it looks unlawful, excessive or outside the agreed service agreement scope.

Worked Example: A Breach In An HR Retainer

Say Priya's consultancy supports a care provider with 80 employees. On Tuesday at 9am, Priya realises an absence spreadsheet has been emailed to the wrong manager at the client. The spreadsheet includes names, absence dates and some health notes for 12 employees.

If the contract says Priya must notify the client without undue delay and, where possible, within 24 hours, she knows what to do. She records what happened, asks the recipient to delete the email, checks whether it was opened or forwarded, and tells the client by Tuesday afternoon.

The client then considers whether it needs to notify the Information Commissioner's Office. If a personal data breach is notifiable, the controller generally has 72 hours after becoming aware of it to notify the ICO. Priya's early notice helps the client make that decision in time.

Security measures should match the sensitivity of the data and the size of your business. You don't need enterprise-level systems for every small consultancy, but you do need sensible, documented controls that you actually follow.

What Should You Include In An HR Consultant Data Processing Agreement?

You should include the clauses required by UK GDPR, plus practical HR-specific details that reflect how you actually work with clients.

Here is a fill-in outline you can use to plan the document. It isn't a finished legal document, and a lawyer should tailor it before you use it with clients.

1. Parties: identify your business and the client, including company numbers if relevant.
2. Relationship With Main Contract: say whether the terms sit inside the HR services agreement or attach as a schedule.
3. Roles: state when the client is controller and when you're processor, plus any separate controller activities you carry out.
4. Processing Description: describe the HR services, types of data, individuals covered and duration of processing.
5. Documented Instructions: explain how the client gives instructions and how you handle instructions that seem problematic.
6. Confidentiality: require your team, associates and approved contractors to keep employee information confidential.
7. Security Measures: list the technical and organisational measures you use, such as access controls, secure storage and staff training.
8. Special Category And Criminal Offence Data: state when this data may be shared and any extra handling rules.
9. Sub-Processors: name key providers or describe the approval process for adding them.
10. International Transfers: cover any transfers outside the UK and the safeguards that apply where needed.
11. Data Subject Requests: set out how you help if an employee makes a subject access request or asks to correct or erase data.
12. Personal Data Breaches: explain notice timing, what information you'll provide and how both sides will cooperate.
13. Return, Deletion And Retention: say what happens to records when the project ends and what limited records you may keep.
14. Audit And Evidence: explain how you'll provide reasonable information about compliance without disrupting your business.
15. Liability And Indemnities: allocate risk fairly, including caps, exclusions and responsibility for each side's own actions.

Templates can be a useful starting point, but HR data has details that generic processor terms often miss. If your work involves grievances, sickness absence, redundancy, TUPE support or DBS checks, the agreement should reflect that.

How Does A Data Processing Agreement Fit With Your HR Services Client Contract?

Your data processing agreement should work alongside your HR services client contract, not sit in a separate drawer that nobody reads.

Your main client contract covers the commercial relationship. Your data processing terms, or a data processing addendum, cover how personal data is handled. They should match each other, especially on services, liability, subcontracting, confidentiality and termination.

For HR consultants, your client contract should usually cover:

• the scope of HR services you'll and won't provide
• fees, payment dates and late payment consequences
• who gives instructions and approvals for the client
• what information the client must provide to you
• timeframes for reviewing drafts and making decisions
• limits on your responsibility where the client ignores advice or delays instructions
• confidentiality and data protection obligations
• insurance, liability caps and exclusions
• termination rights and handover steps

This is especially useful where employment law risk and data protection risk overlap. For example, if a client asks you to prepare redundancy documents but gives you incomplete employee data, your contract should make it clear that the client is responsible for the accuracy of the information it provides.

Your documents should also match your actual systems. If you use a cloud HR platform, shared drive, e-signing tool or external IT provider, your contract shouldn't pretend that everything is stored only on your laptop. Clients appreciate plain, honest wording in your privacy policy and contracts about how their information will be handled.

If a client sends you its own contract, check that it doesn't contradict your standard terms. The order of priority clause can decide which document wins if there's a conflict.

Common Mistakes To Avoid

The most common mistake is treating GDPR terms as a box-ticking exercise instead of a practical operating guide.

Here are a few issues to watch for:

• Using only a confidentiality clause: confidentiality helps, but it doesn't cover the processor terms required by UK GDPR.
• Ignoring special category data: HR files often include health, disability or trade union information, so your agreement should deal with this directly.
• Being vague about sub-processors: if you use HR software, cloud storage, email hosting or IT support, your client should know how those providers fit into the arrangement.
• Promising impossible breach deadlines: a clause requiring notice within one hour may sound impressive, but it may not be realistic for a small consultancy. A workable timeframe is safer than a promise you can't keep.
• Keeping data for too long: your retention position should be clear. Keep what you genuinely need, delete or return what you don't, and record your process.
• Letting client instructions stay informal forever: day-to-day messages are normal, but sensitive or high-risk instructions should be confirmed in writing.
• Accepting unlimited liability without thinking: data protection risk can be significant, so check whether the contract fairly reflects what you control.

If something has already gone wrong, act in order. Secure the data first, record what happened, tell the client promptly, preserve relevant emails and system logs, and get help if the issue involves sensitive HR data or a possible notifiable breach.

Key Takeaways

• HR consultants will often need a written data processing agreement when handling employee data for clients.
• Your agreement should clearly state whether you're acting as a controller, processor or both for different parts of the work.
• HR data often includes special category data, so your security measures and data-sharing boundaries need to be practical and specific.
• Client instructions, breach reporting, sub-processors, deletion and retention should be written down before files are shared.
• Your data processing terms should line up with your wider HR services client contract, especially on scope, liability and confidentiality.
• Generic templates can miss the realities of HR work, so tailored drafting is usually worth it.

If you'd like help with your HR services client contract, data processing terms, confidentiality wording or practical GDPR processes, you can reach us at 08081347754 or team@sprintlaw.co.uk for a free, no-obligations chat.