Data sharing agreements with external organisations
As ERO, you may be obtaining personal data from external partners. For example, you may receive student data from local higher education providers or receive data from care homes regarding their residents. In this situation, the external partner will be a data controller in their own right.
It is strongly recommended that you agree a data sharing agreement or protocol with any external partners and have a written agreement when sharing data between data controllers, even though the legislation does not specifically require it.
A written agreement or protocol will help both you and the external partner demonstrate that you are acting in accordance with the data protection principles and will help to avoid any liability implications of one party being seen as a controller and the other being seen as a processor.
We have produced the following checklist that you can use when developing a data sharing agreement:
Alternatively, your council may have developed a template agreement that you can use. In any case, you should discuss any data sharing agreement with your council’s Data Protection Officer or Information Officer.