Data Processing Addendum (DPA)
Last updated: 1 September 2026
This Data Processing Addendum (“DPA”) forms part of the agreement between Bentley Legal Support Services (“Bentley”, “we”, “us” or “our”) and the client (“Client”, “you” or “your”) where Bentley processes personal data on the Client’s behalf in connection with an agreed service.
This DPA applies only to processing carried out by Bentley as a processor for the Client. Bentley may act as a controller for other processing carried out in connection with its own business administration, legal obligations, billing, security and other independent purposes.
1. Purpose of this DPA
The purpose of this DPA is to set out the parties’ responsibilities where Bentley processes personal data on behalf of the Client and to establish the arrangements governing that processing.
2. Definitions
For the purposes of this DPA, terms including personal data, controller, processor, processing and data subject have the meanings given to them under applicable UK data protection law.
3. Roles of the Parties
The Client determines the purposes and means of the relevant processing where the Client acts as controller.
Bentley processes personal data on the Client’s documented instructions where Bentley acts as processor.
The parties acknowledge that Bentley may act as a controller for certain separate processing activities, including its own business administration, invoicing, legal compliance, security and management of client relationships.
4. Documented Instructions
Bentley will process personal data only on the Client’s documented instructions, unless processing is required by applicable law.
Where applicable law requires Bentley to process personal data other than in accordance with the Client’s instructions, Bentley will inform the Client before carrying out that processing unless the law prohibits such notification.
The Client’s instruction may include the accepted service instruction, supporting documents, written directions and other information reasonably required to carry out the agreed assignment.
5. Purpose of Processing
Where Bentley acts as processor, personal data may be processed for purposes including:
- Serving legal or other documents
- Attending specified addresses
- Carrying out address verification
- Supporting tracing assignments
- Conducting occupancy or property checks
- Recording attendance and service outcomes
- Preparing reports and supporting documentation
- Carrying out other field services expressly instructed by the Client
6. Categories of Personal Data
Depending on the assignment, personal data may include:
- Names and aliases
- Residential or business addresses
- Contact details
- Date of birth or age-related information where lawfully provided and relevant
- Company and director information
- Employment or business information where relevant to the instruction
- Photographs
- Location or GPS information relating to an attendance
- Information contained in legal documents
- Attendance notes and service records
- Other personal data contained within information supplied for the assignment
7. Special Category and Sensitive Information
Some legal matters may contain information falling within special categories of personal data or other sensitive information.
The Client is responsible for ensuring that it has an appropriate lawful basis and, where required, an additional condition for processing such information before instructing Bentley to process it.
Bentley will process such information only where it is necessary for the agreed service and in accordance with the Client’s documented instructions and applicable law.
8. Confidentiality
Bentley will ensure that persons authorised to process personal data on its behalf are subject to appropriate duties of confidentiality.
Personal data will not be disclosed except where necessary to provide the agreed service, comply with the Client’s documented instructions, meet a legal obligation or otherwise as permitted or required by law.
9. Security of Processing
Bentley will implement appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.
Depending on the nature and risks of the processing, such measures may include:
- Access controls
- Account and device security
- Appropriate encryption
- Secure document handling
- Controlled access to case information
- Backups and recovery measures
- Confidentiality requirements
The measures applied will take account of the nature, scope, context and purpose of the processing and the risks to individuals.
10. Assistance with Data Subject Rights
Taking into account the nature of the processing, Bentley will provide reasonable assistance to the Client where the Client needs information or support to respond to a data subject request relating to personal data processed by Bentley on the Client’s behalf.
Where Bentley receives such a request directly and is not independently responsible for responding to it, Bentley will, where appropriate, refer the request to the Client.
11. Personal Data Breaches
Bentley will maintain reasonable procedures for identifying, investigating and responding to personal data breaches affecting information processed on behalf of the Client.
Where Bentley becomes aware of a personal data breach affecting Client personal data in its role as processor, Bentley will notify the Client without undue delay, subject to applicable law and the information reasonably available at the time.
Where appropriate, Bentley will provide information reasonably required by the Client to assess and manage the incident.
12. Sub-Processors
Bentley may use appropriate third-party service providers to support the delivery of its services, including providers of hosting, storage, communications, document management or other technical services.
Where such a provider processes Client personal data as a sub-processor, Bentley will take appropriate steps to ensure that the relevant processing is governed by suitable contractual and security requirements.
13. International Transfers
Where personal data processed on behalf of the Client is transferred outside the United Kingdom, Bentley will take appropriate steps to ensure that the transfer is lawful and that applicable safeguards are in place.
14. Assistance with Compliance
Taking into account the nature of the processing and the information available to Bentley, Bentley will provide reasonable assistance to the Client where necessary for the Client to meet its obligations relating to security, data breaches, data protection impact assessments and consultations with the Information Commissioner’s Office or another competent authority.
15. Records and Compliance Information
Bentley will maintain records appropriate to its processing activities and will provide reasonable information necessary to demonstrate compliance with its obligations as a processor, subject to confidentiality, security and applicable legal restrictions.
16. Audits
Where required under applicable law, Bentley will make available information reasonably necessary to demonstrate compliance with the processor obligations applicable to the relevant processing.
Any audit or inspection must be reasonable, proportionate, subject to appropriate confidentiality and security arrangements, and arranged so that it does not unnecessarily disrupt Bentley’s business or compromise information relating to other clients.
17. Client Responsibilities
The Client is responsible for:
- Determining the lawful purpose and means of processing
- Providing lawful and documented instructions
- Ensuring it has an appropriate lawful basis for the processing
- Providing Bentley with accurate and relevant information
- Ensuring that instructions are proportionate to the purpose for which personal data is processed
- Informing Bentley of relevant restrictions or requirements
18. Data Minimisation
The Client should provide only the personal data reasonably necessary for the agreed assignment.
Bentley may request clarification where information supplied appears unnecessary, excessive or insufficient for the agreed purpose.
19. Data Retention and Deletion
Bentley will retain Client personal data only for as long as reasonably necessary for the agreed service, applicable legal or contractual requirements, dispute resolution, insurance requirements and legitimate business purposes.
At the end of the relevant engagement, Bentley will delete or return personal data where required by the Client, unless continued retention is required by applicable law or for the establishment, exercise or defence of legal claims.
20. Return or Deletion of Information
Where the Client requests the return or deletion of personal data at the end of the relevant processing activity, Bentley will take reasonable steps to comply, subject to legal, regulatory, security and backup requirements.
21. Confidential Legal Information
Where an instruction contains confidential legal, financial, insolvency or personal information, Bentley will apply appropriate professional discretion and information-security measures.
22. Photographs and Location Evidence
Where photographs or GPS/location evidence form part of an accepted assignment, such information may contain personal data.
Such information will be handled in accordance with the Client’s documented instructions, applicable law and Bentley’s information-security and retention arrangements.
23. Processing and Fieldwork
Where Bentley processes personal data during an attendance, field enquiry or verification assignment, the processing will be limited to information reasonably relevant to the agreed purpose.
Bentley will not intentionally collect or use unnecessary personal information as part of an assignment.
24. Confidentiality of Client Information
Bentley will not use Client personal data for unrelated marketing or commercial purposes where Bentley is acting solely as processor for that data.
Separate processing undertaken by Bentley as a controller, such as billing, client administration, legal compliance and security, is governed by Bentley’s Privacy Policy.
25. Term and Termination
This DPA applies for as long as Bentley processes Client personal data on the Client’s behalf under an accepted service engagement.
Termination of the underlying service engagement will not automatically end obligations that are intended to continue, including confidentiality, data protection and legally required retention.
26. Order of Precedence
Where there is a conflict between this DPA and another agreement between Bentley and the Client concerning the processing of personal data, the parties will seek to interpret the documents consistently.
Where applicable law requires a particular provision to take precedence, that requirement will apply.
27. No Legal Advice
Bentley Legal Support Services does not provide legal advice concerning data protection compliance, the lawful basis for a Client’s processing or the legal strategy underlying an instruction.
The Client remains responsible for obtaining appropriate professional advice where required.
28. Changes to this DPA
Bentley may update this DPA where reasonably necessary to reflect changes in law, regulatory guidance, technology or its service arrangements.
29. Governing Law
This DPA is governed by the laws of England and Wales, unless applicable law requires otherwise.
30. Contact Us
For questions regarding this DPA or the processing of personal data, please contact:
Bentley Legal Support Services
Email: enquiries@bentleylegal.co.uk
Telephone: +44-7890-197837
Website: www.bentleylegal.co.uk
Related Policies
Privacy Policy | Cookie Policy | Website Terms & Conditions | Service Standards
This DPA is intended as a general framework for processor relationships. It should be reviewed against Bentley Legal Support Services’ actual processing activities, technology providers, sub-processors, retention arrangements and client contracts before being adopted.