Are data sharing agreements required when I access local data?
Where you request to inspect and/or take copies of data, the holder of the data cannot use a statutory or other restriction, including data protection legislation, to refuse the disclosure of data to you.1
Whether you carry out local data matching yourself, or outsource local data matching, the information you receive will contain personal data which is being shared between two data controllers.
Whilst UK data protection legislation does not require a written agreement when sharing data between data controllers, it is good practice to have a data sharing agreement in place.
Such agreements demonstrate that all parties are acting in accordance with data protection legislation and will help to avoid any liability implications of one party being seen as a controller and the other being seen as a processor.
Do I need a data sharing agreement when using data held by a local authority?
Where you are receiving information from your own council, or if you are the ERO for a district council in England, where you are receiving information from a relevant county council, to
ascertain the names and addresses of people who are not registered but who are entitled to be registered, or
identify those people who are registered but who are not entitled to be registered
a written agreement between you and the council regulating the processing of the information should be in place and this agreement should include details about data transfer, storage, destruction and security arrangements.
Our data protection guidance for EROs and ROs provides guidance in relation to your role as data controller and a checklist to help inform the content of data sharing agreements.