Data Processing Agreement for Translation Services

A Data Processing Agreement for translation services is the written Article 28 UK GDPR contract binding a translation vendor as data processor to the client controller’s documented instructions on personal data handling, security measures, sub-processor use, breach notification, and post-project deletion.

How it works

To obtain a DPA with a translation vendor, request the vendor’s standard Article 28 template, redline it against the ten mandatory clauses, agree the technical and organisational measures annex, list the sub-processor chain, and sign electronically before any source files are transferred.

What’s included

Under UK GDPR Article 28, any translation vendor that processes personal data on a client’s behalf becomes a data processor — and that relationship is invalid without a written contract signed before any file changes hands. This page defines what that contract is, what it must contain, and how a translation-services DPA differs from a generic SaaS template.

How it works

1

When is a DPA required for a translation project?

A DPA is required for any translation project where the source or reference material contains personal data. Typical trigger document types include:

See the Document Translation Services for Businesses: A UK Buyer’s Guide for the full checklist of document types that trigger a DPA.

2

When is a DPA not required for translation work?

A DPA is not required when the translation project contains no personal data. Article 28 only engages when personal data is processed, so anonymised or non-personal source material sits outside the obligation.

• Fully anonymised technical datasheets.
• Marketing brochures with no identifiable individuals.
• Patent specifications describing an invention only.
• Product manuals covering machinery, not users.

3

Does the DPA also apply to translation vendors outside the EU or UK?

Yes — UK GDPR and EU data protection law apply extraterritorially. A translation vendor based outside the European Economic Area still needs a DPA plus a valid transfer mechanism when it processes personal data of UK or EU data subjects on behalf of an in-scope controller.

How it works

Translation services trigger four DPA requirements absent from generic SaaS templates: named-linguist NDA flow-down, translation memory and termbase custody, sub-processor authorisation for freelance revisers, and a UK or EEA data-residency clause covering the CAT tool and TMS infrastructure.

How does the linguist-chain flow-down clause work?

The linguist-chain flow-down clause requires every translator, reviser, and project manager to sign an individual NDA before file access. The chain is documented per project in the ISO 17100 project file, so the controller can trace who processed which segment during any audit.

Each linguist is bound to the same Article 28 duties as the vendor. Where audio work sits alongside written translation, the same flow-down governs Transcription Services London engagements.

Who owns the translation memory and termbase containing personal data?

The DPA should confirm the controller owns any translation memory or termbase segments containing personal data. It should define whether segments are retained for reuse or purged at project close, and set the mechanism for extracting or destroying TM entries on a data-subject erasure request.

How is the TMS and CAT tool infrastructure covered?

The DPA should name the TMS and CAT tool used, confirm hosting inside the UK or European Economic Area, list the platform vendor as a sub-processor, and describe access controls, audit logs, and retention settings applied to project workspaces. Data residency default is UK or EEA.

How is machine translation and AI post-editing addressed in the DPA?

The DPA should prohibit the use of public machine translation engines such as Google Translate or ChatGPT for any file containing personal data. AI post-editing is restricted to enterprise engines with no-training guarantees, each disclosed as a sub-processor in the annex.

How it works

1

Are electronic signatures accepted on a translation-vendor DPA?

Electronic signatures are fully accepted on a translation-vendor DPA under Article 28(9), which explicitly recognises electronic form as satisfying the written requirement. A qualified or advanced electronic signature applied through a compliant e-signature platform satisfies the written-form requirement across both the UK and the EU. Email exchange of a signed PDF also meets the threshold in most jurisdictions, though a dedicated e-signature workflow creates a cleaner audit trail. What matters is that both parties have unambiguously assented to the terms before files are transferred.

2

Can a DPA sit inside the master services agreement rather than as a separate document?

A DPA can sit inside the master services agreement as a schedule, annex, or exhibit, provided every Article 28(3)(a)–(h) clause is present, clearly identified, and not diluted by surrounding commercial terms. Embedding it within the master services agreement is common practice for translation framework contracts and standard terms and conditions. However, where Standard Contractual Clauses or a UK International Data Transfer Agreement is also required — for instance, when the translation vendor processes data outside the EEA — those instruments must satisfy their own formal requirements and are typically appended separately, since their wording cannot be amended. Controllers should confirm that all applicable transfer mechanisms are in place alongside the core DPA before any cross-border processing begins.

1

When does a certified translation of a DPA become mandatory?

A certified translation of a DPA becomes mandatory when the document is filed with a data protection authority in another language, produced as evidence in court, or attached to a regulatory audit response requiring a translator’s certificate of accuracy.

2

Which language pairs are most requested for DPA translation?

The most requested language pairs for DPA translation cover both the EU corpus and cross-border technology and life-sciences work. Our translation partner network covers 150+ languages, including:

• English into German, French, Spanish, Italian, Dutch, Portuguese, and Polish for EU controllers.
• English into Arabic, Chinese Simplified, and Japanese for cross-border commercial contracts.

Our translation-services DPA is aligned to UK GDPR, the Data Protection Act 2018, and ISO 17100. It binds every linguist through named NDAs, keeps data inside the UK or EEA by default, and documents the linguist chain in an auditable ISO 17100 project file. This is the same framework applied to sensitive work under Translation Services for Insurance Companies, where claims files carry personal data.

What certifications back the DPA (ISO 17100, ISO 27001, DPA 2018)?

The DPA is backed by four certifications and one statute:

• ISO 17100 — translation-process quality, translator qualifications, and revision workflow.
• ISO 9001 — quality management across the translation process.
• ISO 27001-aligned information-security controls across access control, encryption, incident response, and staff training.
• ISO 4043 — mobile interpretation booth compliance where interpreting sits alongside translation.
• Data Protection Act 2018 — UK jurisdiction enacting UK GDPR into domestic law.

Data is retained for the project lifecycle plus a 30-day dispute window. Full deletion runs within 30 days of project close on written request, with a deletion certificate issued on demand. Translation memory carrying personal data is not reused without the controller’s written instruction.

How to request our standard DPA before onboarding?

To request our standard DPA, email procurement with four inputs:

1. Categories of personal data present in the source files.
2. Source and target languages.
3. Expected annual volume.
4. Preferred signature method.

A countersigned DPA is returned within five working days, ahead of project kick-off. Standard commercial terms cover purchase orders, invoicing, framework agreements, and retainers, with volume pricing on annual commitments.