Data sharing agreement

This template is for two organisations that each decide, on their own account, why and how they use the same personal data. Both are controllers. Neither is acting on the other's instructions.

If one of you only handles the data as told by the other, this is the wrong document. That relationship needs a processor agreement meeting Article 28 of the UK GDPR. Getting the roles wrong at the outset makes everything that follows wrong, because the obligations, the liabilities and the information each side owes to individuals all turn on which party is deciding what.

Schedule 1 does the work

The sharing is lawful only if each party can name the categories of data, the people the data relates to, the purpose it is shared for, its own lawful basis, how long it will keep the data and what it may not do with it. Schedule 1 is a table with a row for each category, and it should be completed before anyone signs rather than after. An agreement with an empty schedule records an intention to share, not a lawful basis for doing so.

What the clauses cover

The status of the parties and the purpose of the sharing. The shared personal data itself, lawful basis and fair processing, and transparency, which is the obligation to tell people their data is being shared before it happens. Data subject rights, and who answers a request when one arrives. Security. Personal data breach, including what each party must tell the other and how quickly. Retention and deletion. Onward disclosure and international transfers. Accountability, records and review. Then warranties, indemnity and liability, term and termination, and a second schedule for the practical arrangements, including the direction of the sharing, its frequency and its volume.

Special category data

Clause 4 gives two options covering special category and criminal offence data. Keep the one that applies and delete the other. Health data, biometric data and anything revealing beliefs or origins need an Article 9 condition on top of the lawful basis, and in most cases a Schedule 1 condition under the Data Protection Act 2018 as well.

Before you sign

Take advice before sharing outside the United Kingdom, before sharing at scale, and before sharing health, biometric or other sensitive data. A data protection impact assessment may be required, and where it is, it is required before the sharing starts. Sharing that has already begun cannot be assessed retrospectively into compliance.