When one controllerControllerDecides why and how personal data is processed. Carries most of the duties, and most of the penalties. shares personal dataPersonal dataAny information relating to an identified or identifiable living person, including identifiers and combinations of data that single someone out. with another, both are responsible: the sender for disclosing lawfully, the recipient for using lawfully. A data sharing agreement is not legally required in every case, but the statutory data sharing code, in force since 2021-10-05, treats one as good practice, and without one it is hard to show that either side thought it through.
First, is it sharing at all?
Sending data to a processor is not data sharing; it needs an Article 28 contract instead. Two organisations deciding together why and how to process are joint controllers and need an Article 26 arrangement. A data sharing agreement is for independent controllers.
What the agreement should cover
| Topic | Content |
|---|---|
| Purpose | Why the data is shared, specifically, and what it will be used for |
| Parties | Who the controllers are, and named contacts |
| Data | The data items shared, and why each is necessary |
| Lawful basis | For the disclosure and for the recipient’s use; conditions for special category dataSpecial category dataHealth, genetic and biometric data, racial or ethnic origin, political opinions, beliefs, trade union membership, sex life and sexual orientation. Processing needs an Art 9 condition as well as a lawful basis. |
| Transparency | Who tells people, and what |
| Accuracy | How errors are corrected on both sides |
| Security | Transfer method and the recipient’s controls |
| Retention | How long the recipient keeps it, and how it is deleted |
| Rights | How requests are handled when they reach the other party |
| Onward sharing | Whether the recipient can pass it on |
| Review and exit | When it is reviewed, and what happens when it ends |
| Breaches | How each side tells the other |
Public sector sharing
Public bodies need a legal power to share as well as a lawful basis, and the Digital Economy Act 2017 provides specific gateways for some public service delivery purposes. The DUAA 2025 extended one of those gateways to cover disclosures to improve public services for businesses. Record the power alongside the basis.
Safeguarding and emergencies
Data protection law does not prevent sharing to protect someone at risk. The safeguarding conditions in DPA 2018 Schedule 1, and since 2026-02-05 the recognised legitimate interestsRecognised legitimate interestsA UK-only lawful basis for listed purposes, such as national security, emergencies, crime prevention and safeguarding, where no balancing test is needed. In force from 2026-02-05. for safeguarding and emergencies, exist to make that sharing straightforward. A missing agreement is never a reason not to share in an emergency; record the decision afterwards.
Keep it alive
An agreement filed and forgotten is worse than none, because it records intentions nobody is following. Review it on a schedule, and when the purpose, the data or either party changes.