Data Sharing Agreement

Businesses share data for all kinds of reasons. When the data is personal data, extra care is required, particularly where one organisation shares data with another organisation that will use it for its own purposes.

Available here is a UK GDPR-ready Data Sharing Agreement designed for controller-to-controller sharing (as opposed to controller-to-processor arrangements).

When Should You Use This Template?

Use this template if:

two organisations will share personal data, and both will act as data controllers (the receiving party is not acting under the disclosing party’s instructions);
the sharing will be one-way, but you still want the purposes and permitted uses to be tightly defined;
you want a written framework covering key compliance areas such as lawful and fair processing, data subject rights, retention and deletion, security measures, and breach handling.

This template is not suitable where one party processes personal data on behalf of the other. In that situation, you should use a data processing agreement instead.

Data Sharing Agreement (UK)

A detailed agreement for sharing personal data between two UK-based data controllers, with schedules to define the shared data, stated purposes, and technical and organisational measures.

Why Use This Template?

A controller-to-controller arrangement can create risk if the purposes are not clear, if too much data is shared, or if each party assumes the other is responsible for compliance steps. This template helps you document the arrangement properly by:

defining the purposes for sharing and the data to be shared in a structured way;
setting out each party’s obligations under the UK GDPR and the Data Protection Act 2018, including security, retention, rights handling, and breach management; and
supporting a “review and update” approach so the sharing remains appropriate over time.

For more information about this document, please click on the link below:

Data Sharing Agreement (UK)

Data Sharing Agreement is part of Business . Just £38.50 + VAT provides unlimited downloads from Business for 1 year.

Frequently Asked Questions

We are sharing customer data with another company, do we need an agreement? +

Where you share personal data with another organisation that will use it as its own controller, a written data sharing agreement is strongly recommended. It is not, for independent controllers, an absolute legal requirement in the way a processor contract is, but the ICO data sharing code treats it as good practice and part of your accountability. Sharing without one leaves the purposes, security and responsibilities unclear, which is where problems start.

What is the difference between a data sharing agreement and a data processing agreement? +

It comes down to control. A data sharing agreement covers two organisations that each act as a controller and use the shared data for their own purposes. A data processing agreement covers a processor that only acts on the controller's instructions. If the other organisation decides for itself how to use the data you need a sharing agreement, if it merely follows your instructions you need a processing agreement. Using the wrong one leaves gaps.

What should a data sharing agreement cover? +

It should define what data is being shared and for what specific purposes, name the lawful basis each party relies on and set out the security measures, retention and deletion, how data subject rights and breaches will be handled and each party's responsibilities. Clear purposes and a tight description of the data matter most, because vague sharing and over sharing are the common failings. This template uses schedules to pin those details down.

Is a data sharing agreement legally required? +

For two independent controllers there is no hard rule in the UK GDPR that you must have a contract, but the ICO strongly recommends a data sharing agreement and expects you to be able to demonstrate accountability for the sharing. The position is different for joint controllers, who decide the purposes and means together: they must have a formal arrangement setting out their respective responsibilities. So the answer depends on whether you are independent or joint controllers.

Business Buy Only £38.50 + VAT!
Unlimited Downloads for One Year
No Auto-Renewal

Data Sharing Agreement

When Should You Use This Template?

Data Sharing Agreement (UK)

Why Use This Template?

Frequently Asked Questions

Complementary Templates

Processors and Supplier Contracts

Rights Handling