Data sharing agreement template
A data sharing agreement records the terms on which two organisations that each decide how personal data is used share that data with each other: why, what, how it is protected and when it is deleted. It is agreed before the sharing begins. The parties, the purpose, the data items and the lawful basis are different for each arrangement.
Made by DocuWeave. Use at your own discretion.
What changes each time
27 values. Everything else is your wording, kept exactly.
The parties
- Date of the agreement
- Party A's full legal name, company number, registered office and ICO registration number
- Party B's full legal name, company number, registered office and ICO registration number
- Further parties, if any
Purpose and data
- Purpose of the sharing
- Expected benefit
- Joint controller processing, if any
- Data items: item, from, to, special category or criminal offence data
- Categories of individuals
Lawful basis
- Lawful basis relied on
- Date of the legitimate interests assessment
- Special category or criminal offence condition
- Date of the data protection impact assessment and who completed it
Transparency and consent
- Who gives individuals the privacy notice, and when
- Who collects consent and days to report withdrawal
Method and security
- Method of sharing
- Frequency of sharing
- Security measures
- Hours to report a breach
Rights, retention and review
- Days to pass on a request or complaint
- Contact for each party, with name, role and email
- Joint controller responsibilities, if any
- Retention period
- Treatment of data when the agreement ends
- Review interval
- Notice to end
- Liability cap, if agreed
The rules it usually needs
Written in plain English when the template is set up.
- One of several wordings
“Say that each party is a separate controller, or that the parties are joint controllers for stated processing.”
The joint controller clause appears only on the second form.
- One of several wordings
“Give each party's registered details as a company or as an individual's address.”
Only the chosen form of description appears.
- One of several wordings
“Name the lawful basis: consent, contract, legal obligation, public task, legitimate interests or a recognised legitimate interest.”
Only the chosen basis appears, with its detail such as the assessment date. A note says public authorities cannot use legitimate interests for their tasks.
- One of several wordings
“Give the privacy notice at the point of collection, or update the privacy notice by a stated date.”
Only the chosen approach appears.
- One of several wordings
“When the agreement ends, either delete the data received or keep it only where there is an independent lawful basis and need.”
Only the chosen treatment appears.
- Only when…
“Include the special category and criminal offence data conditions only when that data is shared.”
The conditions relied on are named.
- Only when…
“Include the data protection impact assessment line only when one was completed.”
The date and the party who completed it are written in.
- Only when…
“Include the consent clause only when consent is the lawful basis.”
It says who collects and records consent and how withdrawal is passed on.
- Only when…
“Include the joint controllers clause only when the parties are joint controllers.”
It sets out who gives privacy information and handles requests.
- Only when…
“Include the indemnity cap only when agreed.”
The cap amount is written in.
- Once for each item
“One row in the data table for each data item, and one row for each further party.”
Three data items give three rows, each saying who sends it, who receives it and whether it is special category data.
Questions people ask
What is a data sharing agreement?
A written record of the terms on which organisations share personal data, covering the purpose, the data, the lawful basis, security, individuals' rights and how long the data is kept.
Is a data sharing agreement a legal requirement?
UK data protection law does not require a written agreement for sharing between controllers, but it requires the sharing to be lawful, fair, transparent and secure. The ICO's data sharing code treats a written agreement as good practice.
What is the difference between a data sharing agreement and a data processing agreement?
A data processing agreement is used when one organisation handles personal data on another's behalf. A data sharing agreement is used when each organisation decides for itself how it uses the data.
Does every data share need a lawful basis?
Yes. Each organisation needs a lawful basis under UK GDPR, and a further condition if the data is special category or criminal offence data.
How often should it be reviewed?
The agreement itself sets this. Annual review is common, and a review is also sensible when the purpose, the data or the law changes.
Use this template
It opens in DocuWeave as a template you can check, change and publish. Nothing is used until you do.