Skip to main content

Debt Recovery Hub

Contact Us

UK Creditors: 4 Core Clauses for a Debt Collection Agency Agreement

Related Guides

 

A debt collection agency agreement is the written contract that gives an agency legal authority to chase your debts on your behalf, and it must lock down four things: scope of what the agency can and cannot do, commission and fee mechanics, UK GDPR data-processing terms under Article 28, and compliance with FCA rules on fair treatment. Without those four clause families in writing, you have no enforceable control over how your name gets used to collect money.

TL;DR:

  • A clear agency agreement must specify the scope of authority, including permitted recovery actions and restrictions on legal or subcontracting activities.
  • Commission rates should be tiered based on how long the debt is overdue, with full documentation required to justify lower rates for newer accounts.
  • Contracts must address data processing in accordance with UK GDPR, including sub-processor rules, breach notification timelines, and end-of-contract data deletion.
  • The agreement should include FCA compliance obligations, such as exercising forbearance with vulnerable customers and reporting on customer vulnerabilities.
  • Regular performance reviews, audit rights, and termination procedures with written data return or deletion are critical to manage ongoing risk and data security.
Debtrecoveryhub
Find An Agency Suited To Your Case
DebtRecoveryHub connects you with vetted collection agencies matched to your debt type, amount, age, and location.

Find a suitable agency

Table of Contents

What is a debt collection agency agreement, and when do you need one?

A debt collection agency agreement is a contract that appoints a third party to recover money on your behalf while you retain ownership of the debt. That distinction matters more than most businesses realise. When you appoint an agency, the debt stays yours: the agency acts as your representative, contacts debtors in your name (or its own, disclosed), and hands back whatever it recovers, minus commission. When you sell or assign a debt, ownership transfers permanently to the buyer, who then collects for itself and keeps everything.

Mixing the two up in a contract creates real problems. If your paperwork reads like a sale, but you intended an agency appointment, you can lose the right to withdraw the account, negotiate directly with the debtor, or take it to court yourself later. Get the structure wrong and you may also find you have unintentionally transferred customer data outside your control, which raises separate GDPR headaches.

A written agreement matters for reasons beyond clarity of intent:

  • Legal cover under UK GDPR. If the agency processes personal data (names, addresses, payment histories) on your instructions, you are the controller and the agency is a processor. The ICO is clear that a contract is not paperwork for its own sake; it is what allocates responsibility and demonstrates compliance if something goes wrong.
  • Commercial certainty. Without agreed commission bands, dispute rights, and reporting obligations, you are relying on goodwill when a recovery goes sideways.
  • Regulatory exposure. If the agency mistreats a vulnerable customer or breaches FCA rules while acting for you, an absent or vague contract weakens your position when regulators or ombudsmen come asking who was responsible.

Practical triggers for putting an agency agreement in place: any unpaid invoice past several weeks where internal reminders have failed, any account where the debtor has stopped responding, or any portfolio large enough that ad hoc phone calls to a collector no longer scale. StepChange notes that earlier placement generally improves recovery odds and avoids the messier escalation route of sale or court action, so the contract should exist before you need it, not after a dispute forces the issue.

Core clauses every debt collection agency agreement needs

Every agreement, whatever its length, should cover the same clause families. Treat this as a checklist to run through before signing anything, not a wish list.

  1. Appointment and scope of authority. Define precisely what the agency is authorised to do: send letters and emails, make calls, negotiate payment plans, agree settlements up to a stated percentage of the debt, and report back. Just as important is what it cannot do without your sign-off: initiate legal proceedings, agree write-offs above a threshold, or subcontract the account to a third party without notice.
  2. Fee and commission mechanics. Commission is usually a percentage of what is actually recovered, often banded by how old the debt is (a 30-day account might sit at one rate, a two-year-old account considerably higher, reflecting the extra work involved). Specify whether commission applies to gross recovery or net of costs, whether there is a minimum fee per placement, and who pays for litigation disbursements if court action becomes necessary.
  3. Reporting, KPIs and performance remedies. Require monthly or fortnightly statements showing contact attempts, amounts recovered, and accounts closed as uncollectable. Build in a remedy, such as the right to withdraw underperforming accounts without penalty, if recovery rates fall below an agreed benchmark over a set period.
  4. Warranties, indemnities and liability caps. The agency should warrant it holds any necessary consumer credit permissions and will comply with applicable law. You want an indemnity if the agency’s conduct causes you loss (a mishandled call that breaches CONC rules, for instance), balanced against a reasonable liability cap so the relationship remains commercially workable for both sides.

Pro Tip: Ask for a sample compliance breach report before you sign. If the agency cannot produce one, or the format looks thin, that tells you more about how they will actually behave under pressure than anything in their sales pitch.

Beyond those four pillars, insist on a clause defining what counts as a “successful recovery” for commission purposes; partial payments, disputed settlements, and debtor bankruptcy can each be treated differently, and vague wording here is where disputes usually start. A well-drafted agency agreement template will also separate “recovered” from “collected but not yet remitted,” since timing differences between when the agency receives money and when it pays you can matter for cash flow on larger portfolios.

Data protection and UK GDPR requirements you cannot skip

Article 28(3) of the UK GDPR sets out the minimum terms that must appear in any contract where a processor handles personal data on a controller’s instructions, and debt collection almost always falls into this category. The ICO’s own guidance lists what has to be specified in writing, and skipping any of it is a compliance gap, not a drafting shortcut.

The contract must state:

  • The subject matter and duration of the processing (chasing a defined debt portfolio, for the term of the appointment plus any wind-down period).
  • The nature and purpose of the processing (debt recovery activity, not marketing or any secondary use).
  • The types of personal data and categories of data subject involved (names, contact details, payment history, potentially special category data if a vulnerability is disclosed).
  • The agency’s duty to process only on your documented instructions, maintain a duty of confidence, and implement appropriate technical and security measures.

A statistic worth sitting with: many businesses assume a signed non-disclosure agreement covers their GDPR obligations. It does not. The ICO’s guidance sets out eight specific mandatory terms under Article 28(3), and an NDA typically covers none of them properly. If the agency mishandles data and your contract only has a confidentiality clause, you may find yourself jointly and severally liable for a breach you thought you had outsourced.

Beyond the core terms, the agreement needs to address sub-processors directly: can the agency use a third-party dialler service, a tracing bureau, or an outsourced call centre, and if so, under what conditions? Any sub-processor should be subject to the same data protection terms, and you should retain the right to object to a specific sub-processor on reasonable grounds.

Practical points that matter as much as the legal boilerplate:

  • Breach notification timing. Require the agency to notify you within a fixed window (24 to 72 hours is common) of becoming aware of any personal data breach, not once it has already worked out the scale of the problem.
  • Assistance with data-subject rights. If a debtor submits a subject access request or asks to have their data erased, the agency must assist you in responding within statutory timeframes.
  • DPIA cooperation. For higher-risk processing (large portfolios, special category data), the agency should cooperate with any data protection impact assessment you need to run.
  • Audit and inspection rights. You need the contractual right to audit the agency’s data handling, or appoint someone to do it for you, and the agency must cooperate.
  • End-of-contract deletion or return. Article 28(3)(g) requires the processor to delete or return all personal data at the end of the contract, and you should ask for written certification that this has happened, not just an assurance.

A GDPR-focused review of your agency’s obligations before signing is worth the hour it takes. Most disputes over data handling trace back to a contract that never specified sub-processor rules or deletion timelines in the first place.

FCA rules, CONC and treating customers fairly

The Financial Conduct Authority’s Consumer Credit sourcebook, known as CONC, applies to debt collection activity, and it applies to your agency even though you are the one who signed the original credit agreement or supply contract. CONC 7 covers arrears, default, and recovery, including repossessions, and the FCA’s own handbook is explicit that firms must ensure their agents and any third parties acting for them comply with these rules, not just the firm itself.

That obligation does not disappear just because you outsourced the phone calls. If your agency breaches CONC while collecting on your behalf, the regulatory and reputational exposure can land on you as much as on them, which is why the contract has to build in enforceable safeguards rather than relying on the agency’s own compliance culture.

What this means practically for your agreement:

  • Forbearance and due consideration. CONC requires firms dealing with customers in or approaching arrears to exercise forbearance and give due consideration to their circumstances. Your contract should mirror this obligation explicitly, not assume the agency already knows it.
  • Reasonable suspension periods. A common standard is a 30-day pause on active collection activity while a customer negotiates a repayment plan or disputes the debt; the contract should set this out as a right, not a courtesy.
  • Vulnerable customer reporting. The agency should be contractually required to identify signs of vulnerability (mental health difficulties, bereavement, financial hardship) and report on how those cases are being handled, so you retain oversight rather than discovering a problem after a complaint lands.
  • Limits on continuous payment authorities. If the agency uses a continuous payment authority to collect instalments, the contract should cap how many attempts are made and require the debtor’s ability to cancel to be respected in practice, not just in theory.
  • Repossession safeguards. Where secured debt is involved, repossession should only proceed with your explicit sign-off and after the agency has documented that all CONC-mandated steps were followed.

Pro Tip: Build a quarterly compliance check into the contract rather than a one-off audit at signing. Agencies that were compliant a year ago are not automatically compliant now, especially after the Consumer Duty raised the bar on what “fair treatment” actually requires in practice.

The Consumer Duty adds a further layer: agencies now need to evidence that customers are achieving good outcomes, not just that a process was technically followed. A contract that only references CONC without mentioning Consumer Duty obligations is already a step behind where the regulatory expectation sits. If you want a fuller grounding in what “compliant” actually looks like before you vet an agency, Debtrecoveryhub’s guide to FCA debt collection rules sets out the checklist in more depth, and a dedicated guide on vulnerable customer handling is worth reading before you finalise any reporting clause.

Commercial terms worth negotiating, not just accepting

Commission rates are rarely fixed, whatever an agency’s rate card suggests. The single biggest lever is account age: a 30-day overdue invoice with full documentation is cheap to collect and commands a lower rate, while a two-year-old account with patchy paperwork is expensive to chase and priced accordingly. Volume is the second lever. An agency handling 200 accounts a month for you will usually offer a better blended rate than one handling five.

  1. Negotiate banded commission tied to age, not a flat rate across your whole portfolio. A single rate for everything either overpays on easy recoveries or underpays on hard ones; banding by 0 to 30 days, 30 to 90 days, 90 days to a year, and over a year gives both sides a fairer structure.
  2. Supply full documentation with every placement. Invoices, signed contracts, correspondence history, and any prior payment records all improve your negotiating position and your recovery odds. An agency that receives a thin file will either quote a higher rate or deprioritise the account, reasonably enough, since incomplete files take longer to work.
  3. Set clawback terms for disputed recoveries. If a debtor successfully disputes a payment after commission has already been paid out, the contract should specify whether and how that commission is returned.
  4. Use volume commitments as leverage, carefully. Suppliers will often improve rates in exchange for predictable minimum volumes or exclusivity on a defined account segment, but only commit to volume you can genuinely guarantee; an unmet commitment can trigger penalty clauses of its own.
  5. Build in a performance review point. A quarterly or six-monthly review, tied to recovery rate against an agreed benchmark, gives you a clean exit point if the relationship underperforms, without waiting for the full contract term to expire.

Before agreeing final rates, it is worth comparing what a typical UK commission structure looks like across different account ages, so you know whether a quoted rate is reasonable or opportunistic.

A sample clause bank you can adapt

None of this needs to be reinvented from scratch. Below is a short set of clause structures, written generically so you can adapt the specifics (names, thresholds, jurisdiction) to your own agreement. These are illustrative starting points, not a substitute for a lawyer reviewing your final draft, particularly on a high-value or complex portfolio.

Appointment and authority clause:
“The Client appoints the Agency to act as its agent for the purpose of recovering the debts listed in Schedule 1 (‘the Debts’). The Agency’s authority is limited to: issuing demand correspondence, making telephone contact, negotiating payment plans within the parameters set out in Schedule 2, and reporting recovery status to the Client. The Agency shall not initiate legal proceedings, agree to write off any part of a Debt exceeding [X]% of principal, or subcontract performance of this Agreement to a third party, without the Client’s prior written consent.”

Article 28(3) data-processing clause:
“For the purposes of UK GDPR, the Client is the Controller and the Agency is the Processor. The subject matter of processing is debt recovery activity in respect of the Debts; the duration is the term of this Agreement plus [X] days for wind-down. The nature and purpose of processing is limited to recovery-related contact and reporting. The categories of data subject are debtors named in Schedule 1, and the categories of personal data are name, contact details, and payment history. The Agency shall process personal data only on the Client’s documented instructions, maintain confidentiality, implement appropriate technical and organisational security measures, and shall not engage a sub-processor without the Client’s prior written authorisation.”

Commission structure clause:
No commission is payable on sums subsequently repaid, reversed, or successfully disputed by the debtor, and any commission already paid on such sums shall be refunded to the Client within [X] days."

Audit and termination clause:
“The Client, or an appointed representative, may audit the Agency’s records relating to the processing of personal data and performance of this Agreement on [X] days’ written notice. Either party may terminate this Agreement on [X] days’ written notice; the Client may terminate immediately in the event of the Agency’s material breach of CONC obligations or UK GDPR requirements.”

The table below sets out what each clause family should specify, so you can check a draft agreement against it line by line.

Clause family Must specify Common gap
Appointment and scope Permitted actions, prohibited actions, settlement authority limit No cap on write-off authority
Data processing (Article 28) Subject matter, duration, data types, sub-processor rules Sub-processors not addressed at all
Commission Rate bands by age, basis (gross or net), clawback terms Flat rate regardless of account age
Audit rights Frequency, scope, who can conduct it Right exists on paper but no mechanism to exercise it
Termination Notice period, immediate-termination triggers, data return Vague “reasonable notice” with no fixed period

Ending the relationship: termination, data return and what comes next

How you exit an agency agreement matters almost as much as how you enter it. A contract that goes quiet on termination leaves you exposed exactly when things are already going wrong, whether that is a performance failure, a compliance breach, or simply the end of a fixed term.

Set a standard notice period (30 to 90 days is typical for a debt recovery relationship) for termination without cause, but build in immediate-termination triggers for serious breaches: a CONC violation, a data breach caused by the agency’s negligence, or repeated failure to meet reporting obligations. If the agency is actively pursuing a court claim or has an existing repayment plan in negotiation when the relationship ends, the contract should require it to hand over full case files and preserve the status of any ongoing action, so a replacement agency (or you, directly) can pick it up without losing ground.

On data, the requirement is straightforward under Article 28(3)(g): the agency must delete or return all personal data at the end of the contract, and you should ask for this in writing, not verbally confirmed.

  • Written certification of deletion, not just an email saying “done.”
  • A defined retention period for any records the agency must keep for its own regulatory purposes, clearly separated from data returned to you.
  • Continued access to historical records for a limited period after termination, in case a dispute or audit arises later.
  • The right to a post-termination audit, particularly where the relationship ended over a compliance concern rather than simple non-renewal.

Skipping this stage is where most of the real risk in an agency relationship actually sits, since a poorly closed contract can leave data scattered across systems you no longer have visibility over.

How Debtrecoveryhub helps you find the right agency from the start

Every clause covered so far assumes you already know which agency you are contracting with. That is often the harder problem. Debtrecoveryhub’s platform matches your case to vetted agencies based on debt type, amount, age, and location, rather than leaving you to cold-call providers and hope one turns out to be a good fit.

The intake process asks for the details that actually affect fee negotiation and placement outcomes: how old the debt is, whether you have full documentation, the debtor’s location, and whether the case involves consumer debt, a commercial invoice, or something more specialist like a cross-border claim. That detail matters because, as covered in the commercial terms section above, account age and documentation quality are the two biggest drivers of the commission rate you will actually be offered. Turning up to a negotiation with a vague description of “an old unpaid invoice” puts you at a disadvantage before the conversation even starts.

If you are preparing to approach an agency, gather your invoices, any signed contracts or terms of business, a full correspondence history with the debtor, and a note of any prior payment or dispute activity. That is the same documentation an agency will want to see in the placement file, and having it ready before you submit a case through the platform speeds up matching and improves the quality of the quotes you receive. For businesses chasing unpaid commercial invoices specifically, Debtrecoveryhub’s unpaid invoice recovery service is a natural starting point for that intake.

Confidentiality clauses beyond data protection

Data protection covers personal data, but a debt collection agency agreement usually needs a separate confidentiality clause too, one that protects information that is not personal data at all. Think commercial terms, account structures, internal escalation policies, and any proprietary scoring or prioritisation methods you share with the agency to help it work your portfolio effectively.

A standard confidentiality clause should cover both directions. You are sharing sensitive commercial information with the agency, and the agency may in turn be sharing its own methods or systems with you during onboarding. The clause should specify what counts as confidential information, how long the obligation survives after termination (typically two to five years, sometimes indefinitely for genuinely sensitive material), and what the exceptions are: information already public, information independently developed, or disclosure required by law or regulator.

Where agreements often fall short is in failing to address subcontracted staff and freelance agents. If the agency uses external callers or a satellite office, your confidentiality obligations need to bind those third parties too, not just the agency’s core employees. Without that extension, information can leak through a route the contract never anticipated.

It is also worth stating explicitly that confidentiality obligations survive termination of the agreement. An agency that stops working for you should not be free to use your account insights, pricing structures, or debtor lists for any other purpose the moment the contract ends.

Dispute resolution: mediation, arbitration and jurisdiction

Every agency agreement should specify what happens when the parties disagree, because disputes over commission calculations, disputed recoveries, or alleged compliance breaches are common enough that leaving the process undefined just guarantees a messier fight later.

A tiered approach works well in practice. Start with a defined escalation path: disputes first go to named representatives on each side for informal resolution within a set period, commonly 14 to 28 days. If that fails, many agreements then require mediation before either party can proceed to formal proceedings, since mediation is faster and considerably cheaper than litigation for most commercial disagreements of this size.

Tiered debt dispute resolution process

Arbitration is worth considering for higher-value portfolios or where confidentiality of the dispute itself matters, since arbitration proceedings are private in a way court proceedings are not. It does add cost, though, so for smaller relationships a straightforward jurisdiction clause pointing to the courts of England and Wales (or Scotland, if that is where your business is based) is often sufficient and considerably cheaper to invoke if things do go wrong.

Whichever route you choose, state it explicitly. A contract silent on dispute resolution defaults to litigation in whatever jurisdiction a claimant chooses to bring proceedings, which is rarely the outcome either party would have picked deliberately.

What communication methods and frequency should the contract allow?

The contract should set explicit rules on how the agency contacts debtors, not leave it to the agency’s internal policy, because how debtors are contacted is one of the areas regulators scrutinise most closely under CONC.

Specify which channels are permitted: letters, email, SMS, and telephone calls are standard, but you may want to exclude certain channels for particular account types (no calls to a workplace number, for instance, or no SMS for accounts involving disclosed vulnerability). Set a maximum contact frequency too. A common standard limits calls to a set number per week and prohibits contact outside reasonable hours, generally 8am to 9pm on weekdays with tighter restrictions at weekends.

The contract should also require the agency to log every contact attempt, successful or not, so you have a complete record if a debtor later complains about being contacted excessively. This record-keeping requirement doubles as your evidence base if a regulator or ombudsman ever asks how the account was handled.

Finally, address what happens once a debtor formally requests no further contact, or asks that all communication go through a solicitor or debt adviser. The contract should require the agency to honour that instruction immediately and document compliance, since continuing contact after such a request is one of the more common sources of formal complaints against collection agencies.

Insurance requirements for the agency

A debt collection agency should carry professional indemnity insurance covering errors, omissions, and negligence in the course of its work, and your contract should require evidence of current cover before the relationship begins, not just a promise that cover exists.

Ask for a minimum indemnity limit appropriate to the size of the portfolio you are placing; an agency handling a handful of small accounts needs less cover than one managing a multi-million-pound corporate debt book. Public liability insurance matters too if agency staff ever visit premises as part of tracing or negotiation work, and cyber liability cover is increasingly relevant given how much personal data the agency will be processing on your behalf.

Build a requirement into the contract that the agency notifies you if its insurance lapses, is cancelled, or is materially changed during the term, and that it provides a renewed certificate of insurance annually without you having to chase for it. An agency reluctant to share proof of cover, or one whose policy limits look thin relative to the value of debt you are placing, is telling you something about how seriously it takes its own risk exposure.

Compliance beyond FCA and CONC: the Consumer Credit Act and other obligations

FCA rules and CONC get most of the attention, but a debt collection agency agreement needs to address other legislation too, depending on the type of debt involved. The Consumer Credit Act 1974 still governs certain regulated credit agreements, and if any of your debts arose under a regulated credit agreement, the agency needs to understand and comply with the notice and default requirements that Act imposes, separately from CONC.

Where debts involve consumers, the Consumer Protection from Unfair Trading Regulations 2008 prohibits misleading or aggressive collection practices, and a contract silent on this leaves you dependent entirely on the agency’s own internal training. The Administration of Justice Act 1970 also makes it a criminal offence to harass a debtor with demands designed to cause alarm or distress, which is a useful backstop clause to reference explicitly if you want the agency’s obligations to be unambiguous.

For business-to-business debt, the Late Payment of Commercial Debts (Interest) Act 1998 may entitle you to statutory interest and compensation on top of the principal owed, and the contract should specify whether the agency is instructed to pursue this additional recovery or stick to principal only. Getting this wrong in the contract can mean leaving genuine additional recovery on the table simply because nobody specified it should be pursued.

Author perspective: the mistakes I keep seeing in agency contracts

The pattern I notice most often isn’t a missing clause. Its scope creep in the appointment clause itself, wording so loose that an agency ends up with implied authority to do things nobody actually intended, like agreeing settlements at a discount the client never sanctioned. The second recurring blind spot is treating Article 28 as a box to tick rather than a live obligation. Businesses sign it once and never revisit it, even when the agency changes its sub-processors or IT systems eighteen months later.

Weak audit rights are the third failure, and the most avoidable. A right to audit that nobody ever exercises is not a control, it is decoration.

Treat the contract as something you review, not something you file. Set a calendar reminder for a six-monthly check against performance and compliance reporting. For anything above a modest portfolio value, or anything involving vulnerable customers at scale, get a solicitor to review the final draft before signing. The cost is small next to the exposure a bad contract creates.

— Jack

Put your agreement on the right footing from the start

There are platforms that match your case to debt collection agencies based on your debt’s type, amount, age, and location, with the detail that shapes fair commercial terms gathered upfront.

Debtrecoveryhub

That matters because, as this guide has set out, the strength of your agreement depends heavily on the quality of information you bring to the negotiation table. A vague brief gets a vague quote. A detailed intake, covering documentation, account age, and debtor location, gives you a stronger starting position for commission bands, reporting obligations, and every other clause covered above.

If you are chasing unpaid commercial invoices right now, start with Debtrecoveryhub’s Business Debt Recovery service, submit your case details, and get matched with agencies suited to the specific profile of what you are owed, rather than negotiating from a position of uncertainty.

Primary sources worth consulting directly

Before finalising any agreement, go to the primary sources rather than relying solely on secondary guides, however thorough:

Sources

FAQ

Do I have to pay a debt that has been sold to a collection agency?

Yes. Selling a debt transfers legal ownership to the buyer, but the underlying obligation to pay does not disappear, it simply now sits with the new owner. This differs from an agency appointment, where the original creditor still owns the debt and the agency collects on their behalf.

Can I refuse to deal with a debt collector?

You cannot make a genuine debt disappear by refusing contact, but you have the right to request that communication happens through a specific channel, such as in writing only, or through a solicitor or debt adviser. A properly drafted agency agreement should require the collecting agency to honour such requests immediately.

What should you not say to a debt collection agency?

Avoid making promises about payment amounts or dates you are not certain you can keep, and avoid confirming details about the debt (its exact amount, whether it is definitely yours) without checking the agency’s paperwork first. If a debt is disputed, say so clearly and ask for evidence rather than agreeing to anything on the call.

CONC does not mandate an exact number of days, but the FCA’s rules require firms to give customers reasonable time to negotiate a repayment plan, and 30 days is a commonly used benchmark that many agency agreements build in as a contractual standard.

What happens to my data when the agency contract ends?

Under Article 28(3)(g) of the UK GDPR, the agency must delete or return all personal data at the end of the contract, and a well-drafted agreement will require written certification of that deletion rather than a verbal assurance.

Category :

Share :

Facebook X-twitter Linkedin-in