What is a data sharing agreement, and when should you have one?

What it is

Sharing between controllers needs a lawful basis for the disclosure and for the recipient's use, fairness and transparency to the people affected, and security. The data sharing code of practice, issued under DPA 2018 s.121, is statutory: courts and the regulator must take it into account.

When you should have one

• Routine or systematic sharing with another controller. Data sharing code (DPA 2018 s.121)
• Joint controllers must determine their respective responsibilities in an arrangement, and make its essence available to people. UK GDPR Art 26
• Sharing that could create a high risk, which also needs a DPIA. Art 35

When a one-off decision is enough

• One-off or emergency sharing, such as to prevent harm. Record the decision and the reasons instead.

Who is responsible

Each controller, which remains responsible for its own compliance.

What it involves

1. Define the purpose and benefits.
2. Identify the lawful basis for both sides.
3. Limit the data to what is needed.
4. Agree security, retention and deletion.
5. Agree how rights requests, complaints and breaches are handled.
6. Review the arrangement.

If it goes wrong

Regulatory

Unlawful or unfair sharing breaches the principles. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. Departing from the statutory code without good reason counts against you.

Criminal

Disclosing personal data without the controller's consent, knowingly or recklessly, is an offence under DPA 2018 s.170.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.