<!-- Bizible Script --> <script type="text/javascript" class="optanon-category-C0004" src="//cdn.bizible.com/scripts/bizible.js" ></script> <!-- End Bizible Script -->
Contact Sales
Legal Hub

UK GDPR AMS Data Processing Addendum

The Data Processing Addendum that applies where Your Agreement is governed by the law of England and Wales and covers Access Managed Services (AMS)

This UK GDPR AMS Data Processing Addendum applies where the table at clause 2 of the Data Processor Terms identifies it as the Data Processing Addendum for Your Agreement, because Your Agreement covers Access Managed Services (AMS). It forms part of the Data Processor Terms, and sets out the position specific to UK data protection law for AMS. 

The terms that apply across every Data Processing Addendum are at www.theaccessgroup.com/en-gb/legal-hub/documents/data-processor-terms — read this Addendum together with that page. 

1. Definitions 

Approved Jurisdiction — means the United Kingdom, as supplemented by any territory where a Sub-Processor is based in accordance with this Addendum. 

Data Protection Legislation — means the Data Protection Act 2018, the UK GDPR (Regulation (EU) 2016/679 as it forms part of UK law by virtue of section 3 of the European Union (Withdrawal) Act 2018, as amended), the Data (Use and Access) Act 2025, and any other law or regulation applicable in the United Kingdom concerning the processing of personal data, in each case as amended, replaced or repealed. “Personal data”, “data subject”, “controller”, “processor”, “process” and “supervisory authority” are interpreted in line with the UK GDPR. 

Your personal data — means the personal data that You submit to, or that is generated through Your use of, the Services, and that We process on Your behalf under the Agreement. 

Service Fact Sheet — means the content described as a ‘service fact sheet’, made available by Us through the Data Processing Portal. 

2. Our role 

  • 2.1 Except where clause 3.10 of the Data Processor Terms applies, We are the processor and You are the controller of Your personal data. Clause 6 below sets out the subject-matter and duration of the processing, its nature and purpose, the types of personal data involved, and the categories of data subjects. 
  • 2.2 Each of us complies with our respective obligations under the Data Protection Legislation. You warrant that You will not instruct Us to process Your personal data in a way that would be unlawful. 

3. How We process Your personal data 

  • 3.1 We process Your personal data only on Your documented instructions described in clause 6, and We will not transfer it outside the Approved Jurisdiction without a documented instruction to do so — except as set out in clause 3.2 below or clause 3.4 of the Data Processor Terms (Sub-processing).  
  • 3.2 For any transfers to countries without adequacy regulations, We will have and maintain appropriate safeguards to protect Your personal data and to ensure data subjects have enforceable rights and effective remedies, as the Data Protection Legislation requires. 
  • 3.3 We may process Your personal data other than on Your documented instructions where required to do so by law. Unless that law prohibits it on important public interest grounds, We will tell You about the legal requirement before carrying out that processing. 

4. If We consider an instruction unlawful 

  • 4.1 If We consider that an instruction You give Us about processing Your personal data would infringe the Data Protection Legislation, We will tell You immediately, and You will reconsider the instruction in light of Our reasoning. We are not obliged to act on that instruction until You confirm it is non-infringing, or amend it so that it is. 

5. Your responsibilities 

  • 5.1 You are responsible for having and maintaining an appropriate lawful basis needed for the processing of the personal data of the data subjects affected by the Agreement. 
  • 5.2 We will use reasonable endeavours to help You meet Your own obligations under Articles 32 to 36 of the UK GDPR; clauses 3.3 (security), 3.5 (data breaches), 3.6 (individual rights requests) and 3.7 (impact assessments) of the Data Processor Terms set out how. 

6. Details of processing 

  • 6.1 Depending on the nature of the AMS, the details of processing may be captured in the Order, a Service Fact Sheet, Service Description — or in the event none of these exist, as set out in clause 6.2. 
  • 6.2. In absence of the details of processing being covered in collateral described at clause 6.1, this clause 6.2 shall be the documented instructions for processing: 
  • 6.2.1 Subject matter — Your data processed in connection with Us providing the AMS. 
  • 6.2.2 Duration — the duration of this Agreement. 
  • 6.2.3 Nature of the processing — compute, storage, and such other Services as described in Your Order and initiated by You from time to time. 
  • 6.2.4 Type of personal data — the data You provide to Us so that We can provide the AMS described in Your Order. 
  • 6.2.5 Categories of data subjects — may include Your customers, employees, and suppliers. 
  • 6.2.6 Sub-Processors — Our Group Companies, in addition to any Sub-Processor We notify to You in accordance with clause 3.4 of the Data Processor Terms.