Data protection agreements and privacy terms

Data protection documents that hold up

Data processing agreements, privacy notices and the contract paperwork your customers now ask for. £950 plus VAT.

Email me about your data documents

I draft data processing agreements and privacy terms for UK businesses for a fixed fee of £950 plus VAT, delivered in five working days. I am Geoffrey Caesar, a solicitor of England and Wales admitted in 2008, based in London and acting for businesses across England and Wales.

Data protection paperwork usually arrives in one of two ways. Either a customer's procurement team sends a data processing agreement and a security questionnaire and will not sign anything until both are dealt with, or somebody asks a question about your privacy notice that nobody in the business can answer.

The documentation is not the whole of compliance, but it is the part that blocks deals, and it is the part that is straightforward to get right.

What it costs

  • DPA and privacy terms, £950 plus VAT. Data processing agreement plus privacy notice. Five working days.
  • Review of a customer's DPA, £450 plus VAT. They sent theirs and you need to know what you are accepting.
  • Website privacy and cookies pack, £750 plus VAT. Privacy notice, cookie notice and consent guidance.

If you need the DPA as a schedule to a wider agreement I am drafting, it is cheaper to do both together and I will say so.

What you get

  • A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
  • A privacy notice written for people to read rather than to be scrolled past
  • Clear allocation of controller and processor roles, which is where most confusion starts
  • International transfer provisions where you use overseas suppliers
  • Sub-processor and security provisions proportionate to what you actually do
  • A note on the operational steps the documents assume you are taking

What is not included

  • Full compliance audits and data mapping exercises
  • ICO registration, which you do yourself
  • Breach response and regulatory correspondence
  • Cyber security certification such as Cyber Essentials
  • Advice on data protection law outside the UK and EU

How long it takes

Five working days from payment for the DPA and privacy terms, and the same for a review of a customer's DPA in most cases.

How to instruct me

  1. Email me. Send any relevant documents, or three or four lines describing the situation and your deadline. You do not need to prepare a brief.
  2. I confirm the scope, the price and the timetable. In writing, usually the same working day, and if a short call would help I will offer one at no charge. I then invoice you, and the work starts once the invoice is paid. Larger pieces of work can be split into milestone payments if that suits you better.
  3. I deliver on the agreed date. With a call or a follow-up exchange included, so you are not paying again to understand the advice.
✅
The price is fixed in writing before anything starts. It does not move afterwards unless you ask me to do something outside the agreed scope, and I would quote that separately first.

Why instruct me directly

A law firm has premises, partners, support staff, marketing and a compliance department, and every hour it bills has to carry a share of all of it. I have none of that. You are paying for the lawyer and nothing else.

  • Senior attention as standard. The person who reads your contract is the person you emailed. Nothing is delegated to a trainee.
  • In-house and private practice experience. I know what a clause does to a business six months later, not just what it says.
  • No onboarding process. Email, scope, fixed price, invoice, work. There is no client portal to register with and no forms to complete.
  • Better value for the same expertise. Without a firm's overheads, senior time costs less, which is why fixed fees at this level are possible at all.
  • Fixed prices, published. You know the number before you commit. I publish them because cost uncertainty is the main reason businesses do not take advice they need.

Who this is for

  • A customer has sent you a DPA and a security questionnaire
  • You handle personal data for your customers and have nothing in writing
  • Your privacy notice was written years ago or copied from another site
  • You use overseas suppliers and have never documented the transfer position

Questions I am often asked

How much does a data processing agreement cost?

£950 plus VAT for a data processing agreement together with a privacy notice, delivered in five working days. Reviewing a DPA a customer has sent you is £450 plus VAT, and a website privacy and cookies pack is £750 plus VAT.

Are we a controller or a processor?

It depends on whether you decide why and how the data is used. It is common to be a controller for some data and a processor for other data within the same business. Getting it wrong changes your obligations substantially, so it is the first thing we settle.

A customer sent us their DPA. Should we just sign it?

Read it first. Customer DPAs frequently include audit rights, breach notification windows and liability positions considerably more onerous than the law requires. A £450 review usually identifies two or three provisions worth pushing back on.

We use US suppliers. Is that a problem?

Not necessarily, but it needs the right transfer mechanism documented. It is one of the most commonly missed items in SME contract paperwork and one of the easiest to fix.

If you use non-essential cookies or similar technologies, yes, and it needs to actually work rather than merely appear. The website pack covers the documentation and the practical configuration guidance.

Does the paperwork make us compliant?

No, and it is important to be clear about that. A processing agreement describes what you do. If the document says you encrypt data at rest and you do not, the document has made things worse rather than better. The covering note sets out what the paperwork commits you to operationally.

About me

I am Geoffrey Caesar. I have worked on commercial contracts since 2001, first in industry and then in private practice, so I have sat on both sides of the table: as the in-house lawyer who has to live with the contract, and as the external adviser who drafts it.

  • Solicitor of England and Wales, admitted 2008. SRA ID 483394.
  • Practising as an SRA-regulated freelance solicitor under regulation 10.2(b) of the SRA Authorisation of Individuals Regulations. Practice SRA number 666497.
  • Regulated by the Solicitors Regulation Authority and authorised to provide all legal services, including reserved legal activities.
  • Called to the Bar by Gray's Inn in 2005.
  • Working on commercial contracts since 2001, in-house and in private practice.
  • Based in London, acting for businesses across England and Wales.
  • Professional indemnity insurance in place with a limit of £1,000,000 for each claim, with defence costs in addition. Details on request.
  • I do not hold client money.

Two things you should know about instructing a freelance solicitor rather than a law firm. My professional indemnity insurance is not on the SRA's minimum terms and conditions; alternative arrangements are in place instead, and I will give you the details on request. And you can still apply to the SRA Compensation Fund for losses caused by dishonesty or a failure to account for money. Everything else, including the Code of Conduct, the SRA Principles and the Legal Ombudsman, applies to me exactly as it applies to any other solicitor.

✉️
Send me any relevant documents or a short description of the problem. I will reply with a fixed price and a date, usually the same working day.
Email me

Last reviewed: September 2026. Email geoffrey@caesar.co.uk.