Security 1 publisher2 min readPublished September 20, 2026 at 1:09 AM PDT

ICO puts its processor guidance under review after the Data (Use and Access) Act

The page that sets out how UK processors must contract with controllers and authorise sub-processors now says it may change under the Data (Use and Access) Act. The duties on it apply meanwhile, and the revision timetable sits elsewhere.

The Watch · Security desk

Illustration accompanying ICO puts its processor guidance under review after the Data (Use and Access) Act

What happened

The ICO's page on what it means to be a processor now carries a notice saying that, because of changes made by the Data (Use and Access) Act, the guidance is under review and may be subject to change.
The page still sets out nine direct obligations on processors, from acting only on controller instructions through to co-operating with supervisory authorities.
Sub-processors may not be engaged without the controller's prior specific or general written authorisation, and the downstream contract must offer an equivalent level of protection to the upstream one.
Three routes can make a processor pay: ICO enforcement powers and fines, a contract claim by the controller, and a direct claim brought in court by an individual.
Breach notification to the controller is due without undue delay, and the ICO says most controllers expect immediate notice and may write that requirement into the contract.

Compiled by The WatchSomething wrong?How this is made

Why it matters

constraint The ICO's publication schedule sets the date of the rewrite, so a data processing agreement signed as final faces a re-read on the regulator's timing.
exposure The defence against an individual's claim runs through the processor's own paperwork, so the supplier that cannot produce the instruction it acted on is the one carrying the damage.
decision Anyone onboarding sub-processors under a standing general authorisation has to choose between continuing on that basis and routing each new one back to the controller before the guidance is republished.
precedent Contracts that incorporate ICO guidance by reference will change meaning when the regulator republishes the text, without either party signing anything.

The duties on the page apply while the review runs. A processor may still only act on the controller's instructions unless law requires otherwise, and one that steps outside those instructions, or processes for its own purposes, becomes a controller for that processing ^[4].

Two of the nine obligations on the page are paperwork. The first is the binding contract with the controller, which has to carry the compulsory provisions ^[5]. The second is sub-processor authorisation ^[6].

An individual's claim succeeds only where the processor failed UK GDPR provisions that apply specifically to processors, or acted without the controller's lawful instructions or against them ^[16]. Article 82 covers non-material damage, including distress ^[15]. The defence is hard to make out: the processor must prove it is not in any way responsible for the event that gave rise to the damage ^[17]. Documented instructions, and evidence they were followed, are what that proof is made of.

A duty also runs the other way. If a controller's instruction would breach the UK GDPR or local data protection law, the processor has to tell the controller immediately ^[9]. Transfers out of the UK sit on the same footing for processors as for controllers, and each one needs the controller's authorisation as well as compliance with the transfer provisions ^[11].

The notice does not say which of these the Act touched. Its wording is that the guidance "is under review and may be subject to change" ^[1]. The ICO keeps the list of what will be updated, and when, on its Plans for new and updated guidance page ^[2].

What to watch

The ICO's Plans for new and updated guidance page naming a publication date for the revised controllers and processors material.
Whether the rewrite alters the sub-processor wording, in particular the general written authorisation route and the equivalent-protection test.
Whether the updated text changes how the ICO describes the Article 82 defence available to processors.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
The ICO guidance page "What does it mean if you are a processor?" carries the notice: "Due to changes made by the Data (Use and Access) Act, this guidance is under review and may be subject to change."
ReportedSupportedSource: ICO guidance pageView cited source
[2]
The notice states that the Plans for new and updated guidance page will tell you which guidance will be updated and when this will happen.
ReportedSupportedView cited source
[3]
Processors have less autonomy and independence over the data they process, but have several direct legal obligations under the UK GDPR and are subject to regulation by supervisory authorities.
ReportedSupportedView cited source
[4]
A processor can only process personal data on instructions from a controller unless otherwise required by law; acting outside those instructions or processing for its own purposes makes it a controller for that processing.
ReportedSupportedView cited source
[5]
A processor must enter into a binding contract with the controller containing a number of compulsory provisions, and must comply with its obligations as a processor under that contract.
ReportedSupportedView cited source
[6]
A processor must not engage a sub-processor without the controller's prior specific or general written authorisation; where authorisation is given, the contract with the sub-processor must offer an equivalent level of protection for the personal data as the contract between processor and controller.
ReportedSupportedView cited source
[7]
A processor must implement appropriate technical and organisational measures to ensure the security of personal data, including protection against accidental or unlawful destruction or loss, alteration, unauthorised disclosure or access.
ReportedSupportedView cited source
[8]
A processor aware of a personal data breach must notify the relevant controller without undue delay; the ICO states most controllers will expect to be notified immediately and may contractually require this, as they have only a limited time in which to notify the supervisory authority.
ReportedSupportedView cited source
[9]
A processor must notify the controller immediately if any of the controller's instructions would lead to a breach of the UK GDPR or local data protection laws.
ReportedSupportedView cited source
[10]
A processor must comply with certain UK GDPR accountability obligations, such as maintaining records and appointing a data protection officer.
ReportedSupportedView cited source
[11]
The UK GDPR's prohibition on transferring personal data applies equally to processors as to controllers, so a processor must ensure any transfer outside the UK is authorised by the controller and complies with the transfer provisions.
ReportedSupportedView cited source
[12]
A processor is obliged to co-operate with supervisory authorities such as the ICO to help them perform their duties.
ReportedSupportedView cited source
[13]
A processor is subject to the relevant investigative and corrective powers of a supervisory authority such as the ICO and may be subject to administrative fines or other penalties.
ReportedSupportedView cited source
[14]
A processor may be contractually liable to the controller for any failure to meet the terms of the agreed contract, depending on the exact terms of that contract.
ReportedSupportedView cited source
[15]
An individual can bring a claim directly against a processor in court, and the processor can be held liable under Article 82 to pay compensation for damage caused by processing, including non-material damage such as distress.
ReportedSupportedView cited source
[16]
A processor is liable for that damage only if it failed to comply with UK GDPR provisions specifically relating to processors, or acted without the controller's lawful instructions or against those instructions.
ReportedSupportedView cited source
[17]
A processor will not be liable if it can prove it is not in any way responsible for the event giving rise to the damage.
ReportedSupportedView cited source
[18]
The page sets out nine direct processor obligations.
DerivedSupported1 source— sign in to open
[19]
The page describes three routes by which a processor can be made to pay: enforcement by a supervisory authority, contractual liability to the controller, and a direct court claim by an individual.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

cy.ico.org.uk
1 article · September 19, 2026
What does it mean if you are a processor?

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The duties here fall on whoever builds the service that handles someone else's personal data. The ICO is specific about the chain below you: written authorisation from the controller before you engage a sub-processor, and a sub-processor contract whose Article 28(3) terms offer protection equivalent to your own contract with the controller. If the controller gave general authorisation, it either pre-approved a list of sub-processors or approved criteria you can select against, and you must send proposed changes in writing with a date for objections. Security, records and a data protection officer sit on the processor's side of the line too. All of it stays in force while the review is under way.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence78

0100

Primary text, unverified review

Every duty in our coverage is quoted from the regulator's own guidance, down to the two conditions and the defence under Article 82, which is as close to the source as this kind of story gets. The weak part is the notice itself: the ICO says the Data (Use and Access) Act has put the page under review and does not say which passages are affected, and nothing independent sits beside it to fill that in.

AdoptionInsufficient

No practice evidence

Guidance is not a product and this page reports nothing about behaviour: no enforcement examples against processors, no figures on how organisations handle sub-processor authorisation or breach notification in practice. Scoring uptake would need something other than the guidance text.

Hype gap0

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

product
Reform UK bets EU adequacy survives scrapping the ICO's multi-million-pound fines
1 publisher
product
The ICO wants one documented role decision for every processing step in your model chain
1 publisher
build
The ICO fines what you cannot prove: Article 32 makes encryption and erasure an engineering liability
1 publisher
product
Paris prosecutors open a criminal inquiry into women filmed by camera glasses
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Perspective Coverage

Reality

Related stories

Sources