If you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., you are dealing with personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. on behalf of someone else and in accordance with their instructions. In these circumstances, you are only permitted to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. data if you are authorised to do so by the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., This is likely to be specified in your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data.. See Q&A 38 and following for more information about when you need a data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data..

It is a criminal offence to knowingly or recklessly obtain or disclose personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. without the consent of the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. (unless you are legally required to do so) and if you are found guilty, you could face an unlimited fine.

See Data protection obligations for guidance on the difference between a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff..

Sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another business may be a necessary and normal part of your business activities, and something that you are required to do in order to carry out, or perform, a contract with the individual concerned. For example, if the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. has purchased goodsPhysical items being sold. Distinguished from digital content and services, neither of which are physical items. from you through your website, you may need to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. some of their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a courier companyA private company limited by shares incorporated and registered in England and Wales. in order for the goodsPhysical items being sold. Distinguished from digital content and services, neither of which are physical items. to be delivered.

See Q&A 1 for other acceptable reasons to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

This is the most flexible basis on which you can shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. an individual's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. You can rely on this basis in many different circumstances. The interests or purpose can include your own commercial interests, or those of a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract.. Preventing fraud or highlighting a possible criminal act will also be a legitimate interest.

See Q&A 5 for more information.

See Q&A 1 for other acceptable reasons to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

Yes, you can shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. if:

1. you have a legitimate reason or purpose for doing so. This may be the case if your business is part of a group of undertakingsPromises to do or not do something, commonly contained in a contract. and you have a legitimate interest in sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. within that group for internal administrative purposes (eg you need to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. your employeesIndividuals hired personally to work under contracts of employment, usually in exchange for payment. Employees are normally fully integrated into the business and the employer exercises a large degree of control over their work.' personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with your head office for HR purposes); and

2. it is necessary for you to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the data to achieve your purpose. If there is another reasonable way you can do it without sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., you cannot rely on having a legitimate interest; and

3. the individual's interests do not override your reason for sharing. Generally, this will mean that you can use this basis if the individual would reasonably expect you to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. their data in the way you want to.

See Q&A 1 for other acceptable reasons to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

In some circumstances, sharing data with another business may not be a necessary and obvious part of your business activities and if none of the other acceptable reasons apply, you may need to rely on the consent of the individual whose data you want to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. . For example, if you want to sell personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you have collected to external marketing companiesPrivate companies limited by shares incorporated and registered in England and Wales. or data brokers (see Customer data for more information) or if you are merging with another organisation and need to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you have collected with it, it is likely that you will need to obtain the specific consent of the individual concerned.

You are also likely to need the explicit consent of the individual if you wish to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. any sensitive personal dataAlso known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation. about them; see When to use personal data for more information on using (including sharing) sensitive personal dataAlso known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation.. You may have already obtained the consent of the person involved to your sharing their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in a particular way when you initially collected the data from them, therefore you should check your records before deciding whether you need to get additional consent. See Consent to use personal data for more information about how to get the someone's consent to use, or shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. , their data.

See Q&A 1 for other acceptable reasons to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

In some limited circumstances, you may be required to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. without an individual's knowledge or consent. This may be because you have to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the data with a regulatory authority for law enforcement purposes or because the law requires you to, eg as part of a police investigation. Even if this is the case, it is best practice to explain in general terms in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. that in such circumstances, individuals' personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. may be shared. See Q&A 33 for more information about what information to include in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared.. You should also ensure that any decisions you take to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. data in this way are well documented in case your decision to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the data is challenged.

See Q&A 1 for other acceptable reasons to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. someone's personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

Yes, it is recommended that you carry out a data protection impact assessmentA process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a DPIA or privacy impact assessment. (DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment.) before sharing any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to make sure that you have considered the benefits and risks of doing so. In many circumstances it will be a legal requirement for you to conduct one.

For example, you must carry out a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. where:

1. you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. in a way that would not be expected by the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject., eg for marketing purposes. Note that although it will not always be legally required, the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. specifically recommends that data controllers carry out a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. before sharing any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with other data controllers. See Q&A 37 for further guidance about the Code;

2. you are sharing sensitive personal dataAlso known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation., eg employeeAn individual hired personally to work under a contract of employment, usually in exchange for payment. Employees are normally fully integrated into the business and the employer exercises a large degree of control over their work. health records; or

3. there is a change in the risk level, eg because you would like to transfer personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside of the UKUnited Kingdom of Great Britain and Northern Ireland.

See Data protection impact assessments for more information about carrying out a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. and Data Protection impact assessment policy for a template you can use.

Yes, however there are important restrictions on the transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to a separate organisation or individual outside the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 14). This is because once the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. has been transferred outside the UKUnited Kingdom of Great Britain and Northern Ireland, those whose data it is risk losing the protection offered by the UK GDPRThe UK General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the UK. Following Brexit, the EU GDPR was retained in domestic UK law as the UK GDPR. Together with the Data Protection Act 2018, the UK GDPR forms the backbone of data protection law in the UK..

Transfers outside the UKUnited Kingdom of Great Britain and Northern Ireland are only permitted where individuals' rights in relation to their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. are protected in an alternative way to the protection offered by the UK GDPRThe UK General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the UK. Following Brexit, the EU GDPR was retained in domestic UK law as the UK GDPR. Together with the Data Protection Act 2018, the UK GDPR forms the backbone of data protection law in the UK..

Transfers are also permitted if an exception to the restriction on transferring personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. applies.

If you add personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to a website, this will often result in a transfer that is subject to restrictions (see Q&A 14). You can therefore only shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland on a website where it is permitted under the rules.

This is because it is likely that someone outside the UKUnited Kingdom of Great Britain and Northern Ireland will access the information. In this situation, you should make sure that you comply with the rules set out in Q&A 14 and following.

Yes. Before transferring any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland, you should consider whether the transfer of data in the form it is in is actually necessary. For example, it may be possible to make the data anonymous. You could then shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the anonymous data outside the UKUnited Kingdom of Great Britain and Northern Ireland without any restrictions. It is important to remember that to remain anonymous, it should not be possible to identify any individuals from the data, even when combined with other information which is available to the person or business receiving the data.

The restrictions to the transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 14) can apply to a companyA private company limited by shares incorporated and registered in England and Wales. that is in the same group as your companyA private company limited by shares incorporated and registered in England and Wales. . You can therefore only shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland to a group companyIn relation to a company, another company which is a parent company (as defined elsewhere in this glossary) or subsidiary (also as defined elsewhere in this glossary) of that company or which is a subsidiary of any parent company of that company. where it is permitted under the rules.

It is also important to understand that the restrictions apply to the actual transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., and not to where it travels en route. If the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is routed through a server in Australia, for example, but the actual transfer is made within the UKUnited Kingdom of Great Britain and Northern Ireland from one UKUnited Kingdom of Great Britain and Northern Ireland business to another, then the restrictions do not apply.

Under the UK GDPRThe UK General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the UK. Following Brexit, the EU GDPR was retained in domestic UK law as the UK GDPR. Together with the Data Protection Act 2018, the UK GDPR forms the backbone of data protection law in the UK., you can only make a transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland where:

1. the transfer is to or from countries in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. (see Q&A 15);

2. the transfer is covered by UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations (see Q&A 19);

3. the transfer is covered by appropriate safeguards (see Q&A 20); or

4. the transfer is covered by an exception to the restriction on the transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 23).

If the transfer does not fall within one of the above categories, then you cannot transfer the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland.

Yes, but following Brexit, there are restrictions on you doing so and you will need to comply with the UK GDPRThe UK General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the UK. Following Brexit, the EU GDPR was retained in domestic UK law as the UK GDPR. Together with the Data Protection Act 2018, the UK GDPR forms the backbone of data protection law in the UK. at all times in relation to your data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it..

The rules applicable to your data sharing will depend on whether your transfer is:

1. from the UKUnited Kingdom of Great Britain and Northern Ireland to an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country, see Q&A 16; or

2. from an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country to the UKUnited Kingdom of Great Britain and Northern Ireland, see Q&A 17.

The UKUnited Kingdom of Great Britain and Northern Ireland government has confirmed that transfers of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from the UKUnited Kingdom of Great Britain and Northern Ireland to countries in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. are not restricted following Brexit and no additional steps are required for you to make a transfer.

See Q&A 17 if you will be receiving personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway..

On 28 June 2021, the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adopted an adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. in respect of the UKUnited Kingdom of Great Britain and Northern Ireland. This means that personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. can continue to flow freely from countries in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. to the UKUnited Kingdom of Great Britain and Northern Ireland without additional safeguards being introduced. Note that there is an exception for personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. processed for immigration control purposes, guidance for which is outside the scope of this service. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service. See Q&A 18 for further guidance about EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisions.

It is important to bear in mind that the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. for the UKUnited Kingdom of Great Britain and Northern Ireland is time limited and will automatically expire after four years unless it is renewed. The EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. will also monitor any data protectionThe area of law which deals with the way in which data can be handled. developments in the UKUnited Kingdom of Great Britain and Northern Ireland and may amend, suspend or repeal its adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. in the future if it determines that the UKUnited Kingdom of Great Britain and Northern Ireland no longer adequate protection for individuals' rights and freedoms in relation to their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. If the adequacy is withdrawn, there may be implications for the the mechanism you rely on to receive personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway., and for EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you collected on or before 31 December 2020 (see Q&A 24 for further guidance).

This means that the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. has decided that the legal protection available in the country, territory or sector in which the business receiving the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. operates provides adequate protection for individuals' rights and freedoms for their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. An up-to-date list of the countries for which the EUThe European Union has made an adequacy finding can be found on the European Commission's data protection website. The EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. made an adequacy determination in respect of the UKUnited Kingdom of Great Britain and Northern Ireland on 28 June 2021 (see Q&A 17).

Now that the UKUnited Kingdom of Great Britain and Northern Ireland has left the EUThe European Union, UKUnited Kingdom of Great Britain and Northern Ireland organisations are still able to rely on EUThe European Union adequacy decisions to make international data transfers from the UKUnited Kingdom of Great Britain and Northern Ireland as UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations have been made in respect of all countries covered by an EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. as at 31 December 2020 (see Q&A 19). If you will be receiving personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from a country outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. the rules will be different; see Q&A 19 for further guidance.

Note that on 16 July 2020, the European Court of Justice issued a judgment invalidating the US Privacy Shield. This means that the Privacy Shield can no longer be relied on to transfer personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. (including by businesses in the UKUnited Kingdom of Great Britain and Northern Ireland). Businesses should instead put in place other appropriate safeguards (see Q&A 20). Full guidance on transfers of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to the US is outside the scope of this service and you should speak to a lawyer if you have any concerns. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service.

Prior to Brexit, businesses in the UKUnited Kingdom of Great Britain and Northern Ireland could transfer personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to countries outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. if an EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. had been made in respect of that country (see Q&A 18 for information about EUThe European Union adequacy decisions).

Now that the transition period is over, you will be able to make a transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from the UKUnited Kingdom of Great Britain and Northern Ireland to countries outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. if the transfer is covered by UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations. A full list of the countries and territories currently covered by UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations can be found on the ICO's website. It includes all countries covered by EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisions in force at the end of the Brexit transition period on 31 December 2020. If there is no UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulation in place, you will need to consider how else you can make a permitted transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 14).

If you will be receiving personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from countries outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway., you and the sender will need to consider local law data protectionThe area of law which deals with the way in which data can be handled. requirements. The UKUnited Kingdom of Great Britain and Northern Ireland Government is currently working with those countries covered by EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisions to make arrangements for their continued flow of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to the UKUnited Kingdom of Great Britain and Northern Ireland. You should seek legal advice from a lawyer if you are unsure whether your data transfer is permitted. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service.

Appropriate safeguards are certain agreements that allow you to make a transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland.

If the other country is not within the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. and neither falls within the UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations (Q&A 19) nor is subject to an exception (Q&A 23), you are will need to put appropriate safeguards in place to be able to transfer personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. Those most likely to be relevant to your business are:

1. where both your business and the entity receiving the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland are part of a multinational group (including franchises or joint ventures) and have signed up to an internal code of conduct, also referred to as UKUnited Kingdom of Great Britain and Northern Ireland Binding Corporate RulesThis could refer to either EU Binding Corporate Rules or UK Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within one country to another. (UKUnited Kingdom of Great Britain and Northern Ireland BCRs) (see Q&A 21); or

2. where both your business and the entity receiving the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland have signed a contract which contains standard data protectionThe area of law which deals with the way in which data can be handled. clausesProvisions or sections. Usually in a contract. , 'Standard Contractual ClausesProvisions or sections. Usually in a contract. ' (SCCs) or model clausesProvisions or sections. Usually in a contract. (see Q&A 22).

Importantly, the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. recommends that businesses carry out a risk assessmentThe process of looking at what hazards may be present when doing a certain activity, or in a certain area, and the steps which can be taken to eliminate or reduce those dangers. before relying on appropriate safeguards for their international data transfers. This will enable you to consider whether the appropriate safeguard you intend to use will provide an adequate level of protection in the country to which data is being transferred, or whether you need to take further steps. If you are concerned about your use of appropriate safeguards for international data transfers, you should consider speaking to a lawyer. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service.

If the transfer is not covered by appropriate safeguards, you should consider whether it is covered by an exception to the restrictions. See Q&A 23 below.

UK Binding Corporate RulesA set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the UK to a group entity outside the UK. The rules require approval from the ICO. Once approved, the transfer of personal data can take place under the UK GDPR and in accordance with the rules. (UKUnited Kingdom of Great Britain and Northern Ireland BCRs) are internal codes of conduct signed up to by businesses which are part of a multinational group (including franchises or joint ventures). They permit a business in the UKUnited Kingdom of Great Britain and Northern Ireland to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a group companyIn relation to a company, another company which is a parent company (as defined elsewhere in this glossary) or subsidiary (also as defined elsewhere in this glossary) of that company or which is a subsidiary of any parent company of that company. outside of the UKUnited Kingdom of Great Britain and Northern Ireland. UKUnited Kingdom of Great Britain and Northern Ireland BCRs must be approved by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals., which began accepting applications for UKUnited Kingdom of Great Britain and Northern Ireland BCRs from 1 January 2021. Guidance on how to apply for a UK BCRUK Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the UK to a group entity outside the UK. The rules require approval from the ICO. Once approved, the transfer of personal data can take place under the UK GDPR and in accordance with the rules. is outside the scope of this service. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service.

Note that if your business had an EU BCREU Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the EEA to a group entity outside the EEA. The rules require approval from the relevant EEA authority (the ICO if the group has its headquarters in the UK). Once approved, the transfer of personal data can take place under the GDPR and in accordance with the rules. prior to the end of the Brexit transition period (ie 31 December 2020) for which the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. issued an authorisation, you were automatically eligible for a UK BCRUK Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the UK to a group entity outside the UK. The rules require approval from the ICO. Once approved, the transfer of personal data can take place under the UK GDPR and in accordance with the rules. provided you made the necessary changes to produce a UKUnited Kingdom of Great Britain and Northern Ireland version by 1 January 2021. EUThe European Union BCRs that were not authorised by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. were also required to meet other conditions to be automatically eligible for a UK BCRUK Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the UK to a group entity outside the UK. The rules require approval from the ICO. Once approved, the transfer of personal data can take place under the UK GDPR and in accordance with the rules. after the Brexit transition period, full coverage of which is outside the scope of this service.

Importantly, the European Commission has indicated that old EUThe European Union BCRs approved by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. on or before 31 December 2020 no longer provide appropriate safeguards for businesses in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. who are transferring data to the UKUnited Kingdom of Great Britain and Northern Ireland unless they were also approved by an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. supervisory authority before 1 January 2021. If you are unsure about the status of your EU BCREU Binding Corporate Rules. A set of internal rules that apply within a multinational group of companies where a restricted transfer of personal data takes place from a group entity within the EEA to a group entity outside the EEA. The rules require approval from the relevant EEA authority (the ICO if the group has its headquarters in the UK). Once approved, the transfer of personal data can take place under the GDPR and in accordance with the rules. following Brexit, consider getting some legal advice. For access to a specialist lawyer in a few simple steps, you can use our Ask a Lawyer service.

'Standard Contractual ClausesProvisions or sections. Usually in a contract. ' (SCCs) or model clausesProvisions or sections. Usually in a contract. are standard data protectionThe area of law which deals with the way in which data can be handled. clausesProvisions or sections. Usually in a contract. that are included in a signed contract between your business and the organisation you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with. They set out contractual data protectionThe area of law which deals with the way in which data can be handled. obligations between the organisations sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. See Q&A 20 for when you might need to use them.

Prior to Brexit, SCCs were issued by the European Commission under the EU GDPRThe EU General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the EEA. (EUThe European Union SCCs). Following Brexit, the UKUnited Kingdom of Great Britain and Northern Ireland is able to issue its own SCCs. New UKUnited Kingdom of Great Britain and Northern Ireland SCCs (the International Data Transfer AgreementAlongside the International Transfer Addendum to the European Commission's Standard Contractual Clauses for International Data Transfers (the UK Addendum), this document can be used to make restricted transfers of personal data outside the UK from 21 March 2022. (IDTAThe International Data Transfer Agreement. Alongside the International Transfer Addendum to the European Commission's Standard Contractual Clauses for International Data Transfers (the UK Addendum), this document can be used to make restricted transfers of personal data outside the UK from 21 March 2022. ) and the International Data Transfer Addendum to the European Commission's Standard Contractual Clauses for International Data TransfersAlso referred to as the UK Addendum. Alongside the International Data Transfer Agreement (IDTA), this document can be used to make restricted transfers of personal data outside the UK from 21 March 2022. (UKUnited Kingdom of Great Britain and Northern Ireland Addendum)) came into force on 21 March 2022 and can now be used for transfers of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland. You can find the IDTAThe International Data Transfer Agreement. Alongside the International Transfer Addendum to the European Commission's Standard Contractual Clauses for International Data Transfers (the UK Addendum), this document can be used to make restricted transfers of personal data outside the UK from 21 March 2022. and UKUnited Kingdom of Great Britain and Northern Ireland Addendum on the ICO's website.

Note that if you are using older contracts containing EUThe European Union SCCs, these are no longer valid for sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland. Since 21 March 2024, you are required to enter into a new contract on the basis of the IDTAThe International Data Transfer Agreement. Alongside the International Transfer Addendum to the European Commission's Standard Contractual Clauses for International Data Transfers (the UK Addendum), this document can be used to make restricted transfers of personal data outside the UK from 21 March 2022. and UKUnited Kingdom of Great Britain and Northern Ireland Addendum, or rely on alternative safeguards to make your restricted transfer.

There are several exceptions to the restriction on the transfer of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 14), and the ones that are most likely to be relevant to your business are set out below.

If the transfer is not covered by the UKUnited Kingdom of Great Britain and Northern Ireland adequacy regulations, or is not covered by appropriate safeguards, you can still make the transfer if one of the following exceptions applies (and you comply with the rest of your data protectionThe area of law which deals with the way in which data can be handled. obligations):

1. the individual has given their specific, explicit consent to the restricted transfer. You cannot obtain a general consent for restricted transfers. The threshold for obtaining consent is high. You must provide the individual with details about the transfer, including who the data will be sent to, what data will be sent, and the risks involved in making the transfer to a place which does not provide adequate protection nor appropriate safeguards for personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. See Consent to use personal data for more information on obtaining consent, including the right to withdraw such consent;

2. you have or are about to enter into a contract with the individual, and you need to make the restricted transfer in order to fulfil your obligations under the contract. This exception can only be used for occasional restricted transfers. In addition, the transfer must be necessary to either perform the contract or the steps needed to enter into the contract. It does not cover a transfer to use an IT cloud-based system;

3. you have or are you entering into a contract with an individual which benefits another individual whose personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is being transferred, and you need to make the transfer to fulfil your obligations under the contract. This exception can only be used for occasional restricted transfers, and the transfer must be necessary in order for you to be able to enter into or perform the contract. There must be a close and substantial link between the transfer and the contract;

4. you need to make the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. transfer to establish if you have a legal claim, to make a legal claim or to defend a legal claim. This exception can only be used for occasional transfers, and there must be a direct link between the legal claim and the transfer, which makes it necessary. This exception covers contract claims, criminal cases, pre-trial discovery procedures, and out-of-court procedures. The claim must have a legal basis – this exception cannot be relied upon where there is only the possibility of a claim being brought in the future;

5. you are making a one-off transfer and it is in your compelling legitimate interestsInterests which are lawful and clearly articulated, that consist of real and present concerns as opposed to mere speculation. . Note that the threshold for this exception is very high, and it is for truly exceptional circumstances, and to be used only as a last resort. In order to rely on it, you must have first of all given serious consideration to other appropriate safeguards and exceptions (eg you may be able to obtain consent, even if this involves some work on your part). The personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. must only relate to a limited number of individuals, and the transfer must be necessary for your compelling legitimate interestsInterests which are lawful and clearly articulated, that consist of real and present concerns as opposed to mere speculation. (eg to protect your computer systems from serious immediate harm). You must document a full assessment of the circumstances and put in place suitable safeguards to protect the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (eg strict confidentiality agreements or data retention policies). You must inform the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. of the transfer. You must also inform the individual concerned, and set out your compelling legitimate interest to them.

Prior to the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adopting an adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. in respect of the UKUnited Kingdom of Great Britain and Northern Ireland on 28 June 2021, your business must have ensured that it continued to comply with EUThe European Union data protectionThe area of law which deals with the way in which data can be handled. law (as it stood on 31 December 2020; known as 'Frozen GDPRThe General Data Protection Regulation. This could refer to either the EU GDPR or the UK GDPR. The EU GDPR regulates data processing across the EEA. The UK GDPR retains the EU GDPR in domestic law following Brexit. ') in respect of all personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that was transferred to you from an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country prior to 1 January 2021 (referred to as 'legacy data'). This was in addition to complying with UKUnited Kingdom of Great Britain and Northern Ireland data protectionThe area of law which deals with the way in which data can be handled. law in respect of your processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. activities. Now that the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. has been adopted, you no longer need to process legacy data in accordance with the Frozen GDPRThe General Data Protection Regulation. This could refer to either the EU GDPR or the UK GDPR. The EU GDPR regulates data processing across the EEA. The UK GDPR retains the EU GDPR in domestic law following Brexit. . However, if the EU CommissionThe EU's executive arm. Proposes new EU legislation and implements the decisions of the European Parliament and the Council of the EU. repeals or suspends its adequacy decisionAn EU Commission adequacy decision under the EU GDPR. This means that the legal protection available in the country concerned is good enough that personal data can be transferred there from the EU without further safeguards. in respect of the UKUnited Kingdom of Great Britain and Northern Ireland, you will need to revert to applying the Frozen GDPRThe General Data Protection Regulation. This could refer to either the EU GDPR or the UK GDPR. The EU GDPR regulates data processing across the EEA. The UK GDPR retains the EU GDPR in domestic law following Brexit. to any EUThe European Union legacy data that you hold at that time. It is therefore important that you are able to identify any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that your business processes that was collected from the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. prior to 1 January 2021.

This means that personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. must only be shared where sharing it is compatible with the purpose for which you originally collected it. If your data sharing will be for a different purpose, and you are not required to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the data by law, you will need to obtain the individual's consent. For example, if you hold customers' email address details for the purposes of processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. orders they have placed with you, you cannot shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. (or sell) these details with a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract., or with other companiesPrivate companies limited by shares incorporated and registered in England and Wales. in your group, for marketing purposes, unless you have your customers' specific consent to do so.

Bear in mind that if you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and you are receiving personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from another business (eg because you have acquired that business) you must only process that data in line with the reasonable expectations of the individual involved. For example, if the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. has previously opted out of direct marketingAdvertising or marketing which is targeted specifically at a particular individual (as opposed to being aimed at a general market). For example, an email sent to individual email addresses with details of an online sale. communications, you must respect this choice when carrying out your own marketing. See Obtaining consent for direct marketing for more information. If you want to process the data in another way, you will need to obtain the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject.'s consent to this.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

You must ensure that you only shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that is necessary for the purpose for which you are sharing it. For example, if you need to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a courier companyA private company limited by shares incorporated and registered in England and Wales. to deliver goodsPhysical items being sold. Distinguished from digital content and services, neither of which are physical items. for you, you should shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. name and address information and not other unnecessary information, such as credit card details.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

Yes. You must ensure that the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. is accurate and kept up-to-date where necessary (see The rules about storing data for more information about how to ensure personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are storing is kept accurate and up to date). If you receive a request for personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you are storing to be rectified, you must also (where possible) inform any third parties to whom you have disclosed that data. See Q&A 50 for more information about who is responsible for responding to data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. such as this when data has been shared.

It will also be important that the format in which you shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is compatible with the organisation with which you are sharing it. This is to ensure that the information remains accurate and reliable at all times. For example, you must ensure that your IT systems are aligned so that data is not corrupted when it is transferred. These issues should be considered before any data sharing takes place.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

You must make sure that you do not keep the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you receive from another party for any longer than is necessary for the purpose for which it was shared with you. You should establish time limits for deleting data or reviewing whether it needs to be deleted and agree these in your data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. or data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data.. See Q&A 38 and following for more information about data sharing agreementsAgreements made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. and data processing agreementsAgreements, between data controllers and data processors, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. and The rules about storing data for more information on keeping data.

Bear in mind that you may also be under a legal obligation to keep records of any processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. activities you undertake (see Record-keeping for guidance). Importantly however, the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. recommends that data controllers keep a regularly reviewed record of their data sharing, even if they are not legally required to keep records of your processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. activities. These records should include documents demonstrating how you have complied with your other obligations under the UK GDPRThe UK General Data Protection Regulation which lays down rules on how individuals' personal data is collected, used and stored in the UK. Following Brexit, the EU GDPR was retained in domestic UK law as the UK GDPR. Together with the Data Protection Act 2018, the UK GDPR forms the backbone of data protection law in the UK. when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (eg in relation to your lawful basis for the processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it.). See Q&A 37 for further information about the Code.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

You must put in place appropriate technical and organisational measures to make sure that personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is shared, and subsequently stored by each business, securely. These measures should be set out in your data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. or data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. (see Q&A 38 and following for more information about what information should be included in your data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. or data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data., and Template data processing agreement for a template you can tailor to your circumstances).

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you must ensure that the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you are sharing is protected against unauthorised access, use, loss, destruction or damage while in transit and any business involved in data sharing must at all times ensure a level of securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. appropriate to the risks posed. You could consider anonymising the data before sharing it (eg where you are sharing data for statistical purposes only), which may take the data outside of the scope of data protectionThe area of law which deals with the way in which data can be handled. regulation (see The rules about storing data for more information about anonymisation).

The specific securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures that you need to put into place will depend on the context of your data sharing (eg are you sharing it internally within your group (see Q&A 45) or externally with a business outside of the UKUnited Kingdom of Great Britain and Northern Ireland (see Q&A 9)), as well as the particular risks posed by that context. When determining what measures to implement you should also bear in mind existing technology and the associated costs of any securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures. Examples of the securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures that you should consider implementing include:

1. ensuring you have clear instructions in place about the securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures to be taken in relation to each type of file transfer (eg physical and electronic);

2. encrypting files that are transferred electronically;

3. applying pseudonyms; and

4. ensuring you have adequate access controls so that only those people who require access to personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. are able to gain access.

See Secure data storage for more detailed information about the securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures that you should put in place to ensure that personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. is kept secure at all times.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

You will need to ensure that you have measures in place to comply with your data protectionThe area of law which deals with the way in which data can be handled. obligations, alongside appropriate policies and training for your staffAnybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer.. This includes making sure that someone within your organisation has the skills and knowledge to ensure that you comply with your data protectionThe area of law which deals with the way in which data can be handled. obligations. You may be legally required to appoint a data protectionThe area of law which deals with the way in which data can be handled. officerIn a company: A legally defined term used to refer to the director, company secretary or managers of a company. Officers of a company have certain duties and responsibilities towards the company and can be held liable for company law breaches., but if not you should make sure that you have staffAnybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. within your business who have a reasonable level of knowledge about data protectionThe area of law which deals with the way in which data can be handled. matters and can make sure you comply with your data protectionThe area of law which deals with the way in which data can be handled. obligations. See Data protection officers and staff training for more information about who that person should be and what policies and procedures you should put into place to ensure that you fulfil your data protectionThe area of law which deals with the way in which data can be handled. obligations.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

It is crucial when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that you make sure that the recipient of the data has in place adequate data protectionThe area of law which deals with the way in which data can be handled. safeguards and measures as you may both be liable if either party breachesViolations of a legal or moral obligation. its data protectionThe area of law which deals with the way in which data can be handled. obligations. See Q&A 47 for more information about what happens if a party you have shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with breachesViolations of a legal or moral obligation. its obligations. In practice, you can ensure adequate safeguards are in place by entering into a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. or a data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. which sets out the various obligations and responsibilities of both parties. In some circumstances, you are legally required to have such an agreement in place – see Q&A 38 and following and Template data processing agreement for a template data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. you can tailor to your circumstances.

See Q&A 25 for other key obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., you must be clear and transparent with the person whose data you are sharing from the outset about why you are sharing the data and who you will be sharing it with. You must also provide details about how individuals can exercise their rights in relation to their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (see Q&A 50). It is common to set this information out in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared., provided to the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. when you first collect the data. For example, if you rely on external courier companiesPrivate companies limited by shares incorporated and registered in England and Wales. to make deliveries for you, you should explain in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. that you shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with couriers for this purpose. If you may be required to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with regulatory authorities for law enforcement purposes (eg HMRCHis Majesty’s Revenue and Customs. The government authority which oversees tax and customs.), you should explain this in general terms in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared.. Note that the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. recommends that if your business is a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and you are sharing data with several different data controllers, you should ensure your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. makes it clear which organisation they should contact if they want to make a data subject requestAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. (see Q&A 50 for more information about data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.).

Most busin will publish a link to their privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. on their website, and you may also consider using other methods including dashboardsOn-screen tools that allow users to manage preferences. Often used to indicate how personal data is used and to allow users to manage what is done with the data. and just-in-time noticesNotices used by a company to obtain the consent it needs to process personal data correctly. The notices appear on the individual's screen when they input personal data, and provide information on how the personal data will be used. to effectively deliver privacy information, particularly if information is provided at different times. See When to use personal data and Privacy information for more information about what other information must be included in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared., How to tell people about a privacy policy and a cookie policy for how you should communicate your notice to individuals, and Privacy policy for a template document you can tailor to your circumstances.

You must ensure that your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. is reviewed on a regular basis and updated where necessary to correctly reflect your data sharing activities. A review will also help you analyse any complaints from the public about how you use their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., including how you explain that use. Bear in mind that if you want to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in a new way, you will need to ensure that the relevant individuals are informed about this before you do so. You can do this by updating your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. and ensuring that you bring this change to users' attention before you change your sharing activities.

You should review any provisions about sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland (either to the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. or countries outside the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway.) in your privacy documentation. These will need to be updated to reflect the basis under which you are making those transfers and to reflect the fact that the UKUnited Kingdom of Great Britain and Northern Ireland is no longer a member of the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway.. See Q&A 9 and following for more detail on sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. outside the UKUnited Kingdom of Great Britain and Northern Ireland.

See Q&A 35 for guidance on what your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. should say if the data you are sharing has been provided by a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract..

As a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you may receive shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract., rather than from the relevant individual themselves. You still need to ensure that the individual whose data has been shared has received all the relevant privacy information about how you will be using their data, particularly if you are planning to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another business. See When to use personal data and Privacy information for more details on the data privacy information you must give people about using their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., and Privacy policy for a template privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared., which you can tailor, depending on how you will shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. the data.

In these circumstances, you must provide your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. to the relevant individual:

1. within a month of you obtaining the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.;

2. if you are using the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to communicate with the individual concerned, at the point you first communicate with them, at the latest; or

3. if you are planning to disclose the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to someone else, at the point at which you disclose the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

See Q&A 36 for a list of exceptions to the above rule that you need to provide privacy information if the data has come from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract..

Bear in mind that your business remains responsible for ensuring the integrity of any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that it receives from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract., and for complying with its data protectionThe area of law which deals with the way in which data can be handled. obligations in respect of that data (see Q&A 25). If your business will be using marketing lists bought, rented or otherwise obtained from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract., see Direct marketing for further guidance.

No. There are some limited exceptions to the requirement to provide the individual concerned with your privacy information if you obtain it from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract. source (see Q&A 35), including those set out below.

1. The individual already has your privacy information

   To rely on this exception, you must be able to demonstrate that the individual in question already has your privacy information (eg because the organisation you obtained the data from already provided it to them). If you are unsure what information has been passed on, you should make sure you provide it yourself.

2. Providing the information to the individual would be impossible

   In some circumstances it may be impossible for you to provide your privacy information to the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject.. For example, you may not have their contact details or any reasonable way to get hold of them.

   If you are going to rely on this exception, you must carry out a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. before doing so and publish your privacy information (eg by including a privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. on your website). See Data protection impact assessments for more information on DPIAs, and Data Protection impact assessment policy for a template internal policy that will assist you in fulfilling your DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. obligations.

3. Providing the information to the individual would involve a disproportionate effort

   If the effort it will take you to provide the individual in question with your privacy information would be disproportionate as against the effect that your use of the data will have on them, you may be able to rely on this exception. To do so, you should make a written record of your assessment of the proportionality and conduct a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. before processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. the data. See Data protection impact assessments for more information on DPIAs, and Data Protection impact assessment policy for a template internal policy that will assist you in fulfilling your DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. obligations.

   Considerations you can bear in mind when making your assessment of proportionality include:

   1. the number of individuals involved;

   2. how old the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. is; and

   3. what safeguards you have put in place.

      In any event, if you are relying on this exception you must still publish your privacy information (eg by including a privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. on your website).

4. You are required by law to obtain or disclose the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.

   In some instances, you will be required by law to obtain or disclose personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. which you have obtained from a third partyA person who is not directly involved in an existing relationship, transaction or dispute; for example, someone who is not a named party in a contract. source.

It's a statutory code of practice published by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals., which aims to provide practical guidance to businesses about how to comply with their data protectionThe area of law which deals with the way in which data can be handled. obligations when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. It came into force on 5 October 2021 and applies to the sharing of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. between data controllers. It does not apply to data sharing with data processors.

Although the Code is not technically law, the Information Commissioner must take compliance with the Code into account when considering whether a business has breachedViolation of a legal or moral obligation. its data protectionThe area of law which deals with the way in which data can be handled. obligations. If you do not comply with the Code, you may find it more difficult to demonstrate that you have complied with data protectionThe area of law which deals with the way in which data can be handled. law. Failure to comply with data protectionThe area of law which deals with the way in which data can be handled. law can have serious financial and reputational consequences for your business, including in the most serious cases fines of up to £17.5 million or 4% of your global annual turnoverThe amount of money taken by a business, before deductions (eg expenses, tax etc)., whichever is higher.

Recommendations contained within the Code include:

1. carrying out a DPIAData protection impact assessment: A process to identify and minimise the privacy risks of new projects or policies, by considering their impact on individuals' data privacy. Also known as a privacy impact assessment. before sharing any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. between data controllers (see Q&A 8);

2. entering into a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. (see Q&A 43); and

3. making it easy for individuals to assert their information rights (see Q&A 50).

Relevant guidance for data controllers about how to comply with the Code when sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with other data controllers is set out in this section where applicable.

You are a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor. if you are dealing with personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. on behalf of a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff. and in accordance with their instructions. See Q&A 40 for information on sharing data with a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor..

Yes, if you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., you can shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor.. It is important to remember that you may only shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. that has been shared with you on the written instructions of the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. (or the processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. if you are a sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company.), unless you are required to do so by law. These instructions will usually be contained in your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. (see Q&A 38). This means that you can only shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor. if you have prior authorisation from the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers.. This authorisation can be general or specific (ie in relation to a particular sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company.). If you have a general authorisation, you must inform the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. if you are going to add or replace any sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company..

Yes. Before sharing any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor., you should check your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. to find out what you are permitted to do and when you are permitted to do it.

If you do have the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers.'s authorisation to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor., you must put in place a sub-processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. agreement with the data sub-processorA person or company which uses, stores or otherwise deals with personal data on instructions from a data processor. and ensure that its terms reflect your own contractual obligations with the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers.. It is particularly important that the sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. provides you with sufficient guarantees(1) In the context of debt, contracts under which one person agrees to pay the debtor's debts if the debtor cannot pay themselves. (2) In the context of sale of goods, promises to a customer which are given freely (without charging extra money) that the goods they are buying will meet certain standards, and if they do not the person making the promise will do something to make up for that (eg give a refund, or repair or replace the goods). that it will put in place appropriate technical and organisational measures to ensure that all the relevant data protectionThe area of law which deals with the way in which data can be handled. obligations in respect of that personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. are complied with.

It is important to bear in mind that if the sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. fails to comply with its data protectionThe area of law which deals with the way in which data can be handled. obligations, you will remain fully liable to the controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. for the performance of the sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company.'s obligations. You may therefore wish to ensure that your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. contains appropriate indemnities. See Q&A 47 for more information about who is liable when a party you have shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with breachesViolations of a legal or moral obligation. its data protectionThe area of law which deals with the way in which data can be handled. obligations.

Further information on sub-processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. agreements is currently outside the scope of this service.

Yes. If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you can shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. provided you have a lawful basis for doing so (see Q&A 1) and you comply with your data protectionThe area of law which deals with the way in which data can be handled. obligations at all times (see Q&A 25 and following).

Note that if you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you should also comply with the provisions of the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. (see Q&A 37).

When data controllers are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., there is not the same legal requirement to have an agreement in place as between a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff. (see Q&A 38). However, it is best practice to enter into a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the other data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., and this is also recommended by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. . See Q&A 37 for further information about the Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. .

Note that if you and the other data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. will be acting as joint controllersWhere two data controllers jointly determine the purposes and means of personal data processing. in respect of the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (rather than independent controllers, separately processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. the shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. for your own purposes) then you are required to put in place a joint control arrangement and be transparent about the way in which you and the other joint controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. have apportioned compliance with your respective data protectionThe area of law which deals with the way in which data can be handled. obligations. Whilst you are not required to put in place a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. if you are acting as joint controllersWhere two data controllers jointly determine the purposes and means of personal data processing. , the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. advises that entering into such an agreement can help you to put in place your joint control arrangement (see Q&A 44).

See Q&A 44 for more information on data sharing agreementsAgreements made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data., including what they should say.

This is an agreement entered into between two data controllers which sets out the purpose of the data sharing and each party's rights and obligations when they shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. data with each other. It might also be called an information sharing agreement or a data sharing protocol.

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with another controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers., there is not the same legal requirement to have a data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. in place as between a controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. and a processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. (see Q&A 38). However it is best practice to enter into a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the other controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. as it can help you to demonstrate that you are complying with your data protectionThe area of law which deals with the way in which data can be handled. obligations and is recommended by the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. (see Q&A 43). Your agreement should make it very clear whether you will be processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. the shared data as joint controllersWhere two data controllers jointly determine the purposes and means of personal data processing. , or as separate and independent controllers (see Q&A 43).

If you are entering in to a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data., the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. recommends that you include the following information:

1. the purpose of your data sharing (eg your specific aims and why sharing the data is necessary for those to be achieved);

2. your lawful basis for sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (see Q&A 1 for guidance about the lawful bases available to you). Note that the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. advises that if consent is being relied upon for your data sharing, then your agreement should provide a model consent form used to obtain that consent;

3. who will be involved in the data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. (including contact details for each organisation's DPO or other individual responsible for data protectionThe area of law which deals with the way in which data can be handled.);

4. the types of data being shared, including whether any sensitive personal dataAlso known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation. will be shared;

5. how requests from individuals in relation to their data will be dealt with, including a confirmation that all controllers remain responsible for compliance with their duties under data protectionThe area of law which deals with the way in which data can be handled. law at all times (note that if you will be acting as joint controllersWhere two data controllers jointly determine the purposes and means of personal data processing. rather than separate and independent controllers, the situation may be different; see below); and

6. provisions about information governance (eg for ensuring the accuracy of shared data and rules about how long the data will be kept for and what securityAlso known as a debenture, charge or mortgage, security over an asset or assets (such as cash, debts, real estate or equipment) is given by a borrower (and sometimes a third party such as a shareholder of the borrower) to a lender in case the borrower fails to make a payment due. Security is also used to refer to a personal guarantee of a borrower's payment obligations to a lender, typically given again by a shareholder and sometimes secured over the shareholder's personal assets. In the event of a borrower's failure to make a payment due to a lender, the lender will have the right to sell any asset secured or call in the guarantee. measures will be put in place).

It might also be appropriate for you to consider including indemnities Agreements where one party agrees to compensate another on the occurrence of a specified event.whereby parties in breachA violation of a legal or moral obligation. of their contractual obligations indemnifyTo agree that one party will compensate another on the occurrence of a specified event. the other party for any losses it suffers as a result of the breachA violation of a legal or moral obligation. (see Q&A 48 for more information).

Remember that if you and the other data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. will be acting as joint controllersWhere two data controllers jointly determine the purposes and means of personal data processing. in respect of the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., then you are required to put in place a joint control arrangement (see Q&A 43). The ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. suggests that entering into a data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. can help you to put in place your joint control arrangement. Your joint control arrangement should clearly set out that both parties are acting as joint data controllers in relation to the data that is being shared, and what your respective responsibilities are; for example, which data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. will be responsible for responding to data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. (see Q&A 50 for more information) and how liability will be divided between you in the event of a data breachA violation of a legal or moral obligation. (see Q&A 48). You may want to consider including in your data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. a mechanism for resolving disputes in relation to liability. A summary of your joint control arrangement must be made available to the individual whose data has been shared (eg through a joint privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared. or joint terms and conditions – see Q&A 33 for more information about what should be included in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared.).

You should review your data sharing agreementsAgreements made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. on a regular basis to ensure that they continue to properly reflect your data sharing activities.

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. that is part of a group, then you will generally be able to shareA share in the capital of a company (sometimes also referred to as stock, for example in relation to US companies). Shares in a company give to the holders, known as shareholders, rights in relation to that company such as to vote, to receive dividends and to a return of capital. Holders of shares in a company own that company and the company, not its shareholders, owns the company's assets. personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. within your group companiesCompanies which are either a parent company or a subsidiary company within the same group. as you will have a proper reason for doing so (see Q&A 5). This will be for internal administrative purposes, including the processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. of clients' or employeesIndividuals hired personally to work under contracts of employment, usually in exchange for payment. Employees are normally fully integrated into the business and the employer exercises a large degree of control over their work.' personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual.. However, data protectionThe area of law which deals with the way in which data can be handled. laws still apply to intra-group transfers of personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. such as these and you will still need to fulfil your data protectionThe area of law which deals with the way in which data can be handled. obligations, including the requirement to put in place written agreements where appropriate. Remember that if you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., you must only process personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. (which includes sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with other organisations within your group) on the written instructions of the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. unless you are required to do so by law (see Q&A 38 for more information).

Bear in mind that, prior to the end of the Brexit transition period, UKUnited Kingdom of Great Britain and Northern Ireland businesses sharing data with group companiesCompanies which are either a parent company or a subsidiary company within the same group. in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. were able to identify a lead supervisory authority for that data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it., to avoid dealing with more than one EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. supervisory authority. Now that the UKUnited Kingdom of Great Britain and Northern Ireland has left the EUThe European Union, your business will need to deal with both the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and the local supervisory authority in the relevant EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country if your data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. affects individuals there. See Q&A 46 for more information. If you want to transfer personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. to a group companyIn relation to a company, another company which is a parent company (as defined elsewhere in this glossary) or subsidiary (also as defined elsewhere in this glossary) of that company or which is a subsidiary of any parent company of that company. that is outside of the UKUnited Kingdom of Great Britain and Northern Ireland, there are additional issues to consider and safeguards that you must put into place. See Q&A 9 for further information.

Prior to the end of the Brexit transition period, UKUnited Kingdom of Great Britain and Northern Ireland businesses undertakingA promise to do or not do something, commonly contained in a contract. cross-border data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. within the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. were able to identify a lead supervisory authority for that data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it., to avoid dealing with more than one EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. supervisory authority. Now that the UKUnited Kingdom of Great Britain and Northern Ireland has left the EUThe European Union, your business will need to deal with both the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and the local supervisory authority in the relevant EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country if your data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. affects individuals there. However, if you will be carrying our cross-border data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. with more than one EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country, you should review your business's structure and consider whether you will be able to have an alternative lead supervisory body in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway., which you need to deal with alongside the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. from 1 January 2021. This will be the case if you have offices, branches or other establishments in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway.. Alternatively, if you do not have an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. establishment, you will now need to deal with both the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and the supervisory bodies for each EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country in which you deal with personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual..

If your business is based in the UKUnited Kingdom of Great Britain and Northern Ireland and you have no branch, office or establishment in any EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country, but you offer goodsPhysical items being sold. Distinguished from digital content and services, neither of which are physical items. or services to individuals in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway., or monitor their behaviour, now that the Brexit transition period has ended, you will need to comply with the GDPRThe General Data Protection Regulation. This could refer to either the EU GDPR or the UK GDPR. The EU GDPR regulates data processing across the EEA. The UK GDPR retains the EU GDPR in domestic law following Brexit. as well as the UKUnited Kingdom of Great Britain and Northern Ireland data protectionThe area of law which deals with the way in which data can be handled. regime in relation to your use of that data. This means that unless your use of data is low risk (eg it is occasional or doesn't involve your business using or sharing any sensitive personal dataAlso known as special category data. Personal data which is particularly sensitive in terms of the impact it could have on the rights and freedoms of individuals. It includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a person, data concerning health or data concerning a person's sex life or sexual orientation.), you will need to appoint a representative in the relevant EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. country. This representative will need to be authorised in writing to act on your behalf in relation to your compliance with the GDPRThe General Data Protection Regulation. This could refer to either the EU GDPR or the UK GDPR. The EU GDPR regulates data processing across the EEA. The UK GDPR retains the EU GDPR in domestic law following Brexit. in the EUThe European Union, including dealing with any EUThe European Union supervisory bodies or individuals. As most SMEsSmall and Medium-sized Enterprises: Businesses which are small or medium sized in terms of their staff numbers, turnover or assets. are unlikely to require an EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. representative, detailed guidance is outside the scope of this service.

If a business breachesViolations of a legal or moral obligation. its data obligations, there are several penalties that it could potentially face, including fines from the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals., and paying compensation to the individual whose data the breachA violation of a legal or moral obligation. involved.

A data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. has rights against any business involved in processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. their personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. if they suffer damage because that business has breachedViolation of a legal or moral obligation. its data protectionThe area of law which deals with the way in which data can be handled. obligations. The extent to which either business involved in sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. will be liable to pay compensation to any individual involved will depend on whether they are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. or a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., what the cause of the breachA violation of a legal or moral obligation. was and what the provisions of the data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. or sharing agreement (if an agreement is in place) said.

If you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff. and a data breachA violation of a legal or moral obligation. has occurred, you may need to notify the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and if you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. you may have notification obligations to the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and/or the data subjectsThe individuals to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. themselves.

Failure to notify either the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. or the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject.(s) if required to do so can result in a significant fine of up to £8.7 million or 2% of your global turnoverThe amount of money taken by a business, before deductions (eg expenses, tax etc). (whichever is higher). For more information about how to respond to personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. breachesViolations of a legal or moral obligation. see Obligations when a data breach occurs and Checklist for responding to a data breach for a summary of the steps you should take.

Note that now the Brexit transition period is over, you may need to inform both the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals. and the relevant supervisory bodies in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. (or the lead supervisory body in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. if you have one) if the data breachA violation of a legal or moral obligation. affects individuals in the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway..

See Q&A 48 for liability of data controllers, and see Q&A 49 for liability of data processors.

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., you will be liable for all damage caused by data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. which breaks data protectionThe area of law which deals with the way in which data can be handled. law (even if you are acting as a joint controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. in respect of that data, in which case you and the other data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. will both be jointly liable for the damage). This means that unless you can show that you are not in any way responsible for the breachA violation of a legal or moral obligation. , you will be fully liable for compensating the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject.(s) for any damage caused.

If the processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. or controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. whom you have shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with is also responsible for the breachA violation of a legal or moral obligation. , you will both be liable although the amount you are ordered to pay in compensation may be apportioned according to your level of responsibility. If one of you ends up fully compensating the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject., that business can claim back relevant amounts from the other business involved.

As the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. can apply for compensation from any party involved in the data sharing, for practical purposes you should ensure that your data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. or sharing agreement contains appropriate indemnities to contractually entitle you to claim back any damages An sum of money ordered by a court to be paid to a person as compensation for loss or injury. you have paid as a result of another party's breachA violation of a legal or moral obligation. (see Q&A 38 and following for more information).

See Q&A 49 for information on liability of data processors.

If you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., your liability will largely be set out in your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., and therefore you will be directly liable to the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. for data breachesViolations of a legal or moral obligation. where you have breachedViolation of a legal or moral obligation. the terms of that agreement. However, you also have some direct data protectionThe area of law which deals with the way in which data can be handled. obligations to the individual involved (eg to ensure that any personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you are processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. is secure and to notify personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. breachesViolations of a legal or moral obligation. to the controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. (see Obligations when a data breach occurs for more information and Checklist for responding to a data breach for a summary of steps you should take)). You will be liable to compensate the individual involved directly for any damage caused as a result of you breaching The act of violating a legal or moral obligation.one of those obligations. It is also a criminal offence to knowingly or recklessly obtain or disclose personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. without the consent of the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. (unless you are legally required to do so) and if you are found guilty, you could face an unlimited fine.

Importantly, if you have shared personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with a sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company., and that sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. has breachedViolation of a legal or moral obligation. its data protectionThe area of law which deals with the way in which data can be handled. obligations (either by breaching The act of violating a legal or moral obligation.its data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with you or its own data protectionThe area of law which deals with the way in which data can be handled. legal requirements), you will still remain directly liable to the controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. for any damage caused by that breachA violation of a legal or moral obligation. .

Where you and the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. and/or the sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. (if applicable) are all responsible for the breachA violation of a legal or moral obligation. , you will all be liable to fully compensate the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. unless you can show that you are not in any way responsible for the breachA violation of a legal or moral obligation. . If you are all liable, the amounts that you are each obliged to pay in compensation can be apportioned according to your respective responsibilities. If one of you ends up fully compensating the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject., that business can claim back relevant amounts (proportionate to the levels of responsibility) from the other businesses).

As the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. can apply for compensation from any party involved in the data sharing, for practical purposes, you should ensure that your data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. and data sharing agreementsAgreements made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. contain appropriate indemnities to contractually entitle you to claim back any damages you have paid as a result of another party's breachA violation of a legal or moral obligation. .

See Q&A 48 for liability of data controllers.

If you are a data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., individuals have numerous rights in relation to the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. you hold about them (which remain whether or not you have shared that data), and they may make requests about the data at any time. Examples of such requests include that you provide them with copies of the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. or that you rectify or delete data that you hold about them. If you are sharing personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. with other data controllers, to make it straightforward for individuals to exercise their rights, the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. recommends that you provide (in your privacy policyA statement made by a business explaining what information it collects about individuals and how and why it will be used, stored and shared.) a single point of contact for requests. However, bear in mind that individuals can still make their requests to whichever data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. they want to. See Data subject requests in general for more information about how to respond to such requests and Data subject request policy for a template policy you can use to prepare your staffAnybody who works for a business, whether as an employee, casual worker, apprentice, agency worker or freelancer. for dealing with them.

If you are acting as a joint controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. in respect of the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in question, you must ensure that your data sharing agreementAn agreement made between data controllers, to share personal data with each other, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. sets out which business will be responsible for responding to data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. and ensure that this information is communicated to the data subjectThe individual to which particular personal data relates. For example: if you hold records of employee phone numbers, the employees are data subjects. An individual who has died or cannot be identified does not count as a data subject. (see Q&A 44 for more information about how to do this).

A data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. must generally respond to such requests within one month; simply ignoring a request and failing to adequately reply can be an offence and lead to sanctions, penalties and significant fines. You must also take reasonable steps to inform any third parties with whom you have shared the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in question if the data has been either rectified or deleted in response to a data subject requestAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it.. If you have shared the data widely, you will need to be satisfied that you have done all you reasonably can to inform others of the deletion of the personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual. in question. This does not mean you have to incur disproportionate costs, but at the very least you should ensure you have taken steps to contact other organisations you have shared the data with. See Data subject requests in general for more information about this requirement and Letter to party who has been supplied data to confirm its deletion and Letter to party who has been supplied with data to confirm its correction for template letters to notify another organisation about the data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it..

If you are a data processorA person or company which uses, stores or otherwise deals with personal data on instructions from someone else, eg a payroll provider is data processor for its clients of personal data about their staff., your legal obligations will be set out in your data processing agreementAn agreement between a data controller and a data processor, required under the GDPR, to share personal data with another person or business, which must detail the data involved, what is to be done with it and why, and the roles and responsibilities of each party in relation to the data. with the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers., and you must assist the controllerIn data protection law - the entity which decides how personal data will be processed and the purposes of processing. A data controller may be a person or a company. It may act on its own or jointly with other controllers. insofar as possible, by using appropriate technical and organisational measures, to respond to any data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it.. You must also respond to any requests from the data controllerThe person or company which decides how and why personal data will be processed. It may act on its own or jointly with other controllers. to rectify or delete personal dataAny information about an identifiable, living person. Information which cannot be used to identify someone on its own will still be personal data if it can be used in combination with other information to identify that individual., ensuring that any such requests are communicated to your sub-processorIn data protection: An entity which processes personal data on behalf of a controller. A processor may be a natural person or a company. where applicable. See Template data processing agreement for example data processingIn relation to data protection, processing data covers any action taken in respect of the data, including: collecting, storing, using, disclosing and erasing or destroying it. terms.

Bear in mind that following Brexit and now that the transition period is over, you may need to appoint a representative within the EEAThe European Economic Area. The EU member states, plus Iceland, Lichtenstein and Norway. to deal with data subject requestsAn umbrella term for the different types of request that individuals can make to a business which has personal data about them, eg a request to delete or correct that data, or a request for a copy of it. on your behalf. See Q&A 46 for further guidance.

Finally, the ICOInformation Commissioner's Office. An independent body which upholds information rights in the public interest, promoting and policing data privacy for individuals.'s Data Sharing Code of PracticeA statutory code of practice published by the ICO to provide guidance to data controllers about how to comply with their data protection obligations when sharing personal data. The Code came into force on 5 October 2021. ICO statutory codes of practice are not law, but the ICO must take compliance with them into account when considering whether a business has breached its data protection obligations. recommends that data controllers put in place procedures to deal with any complaints or queries about your data sharing practices, and that you use such feedback to inform your ongoing data sharing.