Data protection agreements and privacy terms

I draft data processing agreements and privacy terms for UK businesses for a fixed fee of £795, delivered in five working days. I am Geoffrey Caesar, a solicitor of England and Wales admitted in 2008, acting for businesses across England and Wales.

Data protection paperwork usually arrives in one of two ways. Either a customer's procurement team sends a data processing agreement and a security questionnaire and will not sign anything until both are dealt with, or somebody asks a question about your privacy notice that nobody in the business can answer.

The documentation is not the whole of compliance, but it is the part that blocks deals, and it is the part that is straightforward to get right.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Website privacy and cookies pack, £595. Privacy notice, cookie notice and consent guidance. Five working days.

If you need the DPA as a schedule to a wider agreement I am drafting, buy both and I will draft them to fit together.

Email me at geoffrey@caesar.co.uk with what you need and any documents, and I will confirm the scope and the fee in writing, usually the same working day.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

How long it takes

Five working days from payment for the DPA and privacy terms and for the website pack, and three working days for a review of a customer's DPA.

How to instruct me

1. Email me. Send me what you need, with any documents, in whatever format you have them.
2. I confirm the scope and the fee. Usually the same working day, in writing. If a call would help before you decide, I will offer one at no charge. Once you confirm, I complete my checks and send my invoice.
3. I start work as soon as payment is received. I will be in touch if I need anything further, and I deliver on the stated turnaround, counted from the day I have everything I need.

Why instruct me directly

You deal with one senior lawyer from first email to final document. The work is done personally, the contact is direct, and the price is published before you ever get in touch.

• Senior attention as standard. I handle your matter throughout. Nothing is delegated to a trainee.
• In-house and private practice experience. I know what a clause does to a business six months later, not just what it says.
• Onboarding that takes one email. Email me, send the documents, get the work. There is no client portal to register with; the checks I need to run happen quickly in the background.
• Stated turnarounds, met. Most work is delivered in three to five working days, stated up front, and priority turnaround is there when the clock is against you.
• Fixed prices, published. You know the number before you commit. I publish them because cost uncertainty is the main reason businesses do not take advice they need.

Who this is for

• A customer has sent you a DPA and a security questionnaire
• You handle personal data for your customers and have nothing in writing
• Your privacy notice was written years ago or copied from another site
• You use overseas suppliers and have never documented the transfer position

Questions I am often asked

How much does a data processing agreement cost?

£795 for a data processing agreement together with a privacy notice, delivered in five working days. Reviewing a DPA a customer has sent you is £495, returned as a mark-up, and a website privacy and cookies pack is £595.

Are we a controller or a processor?

It depends on whether you decide why and how the data is used. It is common to be a controller for some data and a processor for other data within the same business. Getting it wrong changes your obligations substantially, so it is the first thing we settle.

A customer sent us their DPA. Should we just sign it?

Read it first. Customer DPAs frequently include audit rights, breach notification windows and liability positions considerably more onerous than the law requires. A £495 review usually identifies two or three provisions worth pushing back on.

We use US suppliers. Is that a problem?

Not necessarily, but it needs the right transfer mechanism documented. It is one of the most commonly missed items in SME contract paperwork and one of the easiest to fix.

Do we need a cookie banner?

If you use non-essential cookies or similar technologies, yes, and it needs to work rather than merely appear. The website pack covers the documentation and the practical configuration guidance.

Does the paperwork make us compliant?

No, and it is important to be clear about that. A processing agreement describes what you do. If the document says you encrypt data at rest and you do not, the document has made things worse rather than better. The covering note sets out what the paperwork commits you to operationally.

What if questions come up afterwards?

They usually do. A customer sends their own DPA, a supplier asks about a sub-processor, or a question arises about what you can do with a set of data. If it is a point on the document I have just delivered, ask, and I will tell you whether it falls within the fee. For anything new, email me and I will tell you which fixed-fee service fits, or quote a fixed fee if none does.

About me

I am Geoffrey Caesar. I have worked on commercial contracts since 2001, first in industry and then in private practice, so I have sat on both sides of the table: as the in-house lawyer who has to live with the contract, and as the external adviser who drafts it.

• Solicitor of England and Wales, admitted 2008. SRA ID 483394.
• Practising as an SRA-regulated freelance solicitor under regulation 10.2(b) of the SRA Authorisation of Individuals Regulations. Practice SRA number 666497.
• Regulated by the Solicitors Regulation Authority and authorised to provide all legal services, including reserved legal activities.
• Called to the Bar by Gray's Inn in 2005.
• Working on commercial contracts since 2001, in-house and in private practice.
• Acting for businesses across England and Wales.
• Professional indemnity insurance in place with a limit of £1,000,000 for each claim, with defence costs in addition. Details on request.
• I do not hold client money.

Two things you should know about instructing a freelance solicitor rather than a law firm. My professional indemnity insurance is not on the SRA's minimum terms and conditions; alternative arrangements are in place instead, and I will give you the details on request. And you can still apply to the SRA Compensation Fund for losses caused by dishonesty or a failure to account for money. Everything else, including the Code of Conduct, the SRA Principles and the Legal Ombudsman, applies to me exactly as it applies to any other solicitor.

Related services

• SaaS and technology contracts, £995
• AI contracts and AI use policies, from £595
• Your customer and supplier terms, £995

Last reviewed: October 2026. Email geoffrey@caesar.co.uk.