For the sharing of personal data to be considered fair and lawful, it is necessary to explain to the data subjects how the collected personal data will be used and with whom it will be shared. In such data sharing contexts it is important to explain:

• who you are.
• why you intend to share the personal data.
• who you will share it with (these could be specific organisations or categories).

You should provide more information if the nature of the sharing is such that some aspects of it do not sufficiently fall within the reasonable expectations of the data subject regarding the use of their personal data.

You should:

• have an appropriate sharing policy in place that establishes when it is appropriate to share or disclose data.
• ensure that the sharing policy and procedures set out the methods used by staff to ensure sharing is legal, how data accuracy is maintained, and what security measures are put in place before any information is shared.
• specify in your sharing policy how compliance with these requirements will be achieved.
• communicate the architecture of your sharing policy to all staff.

You should:

• provide adequate ongoing training for staff who regularly make decisions about sharing personal data with third parties.
• verify that staff with specific responsibilities for managing or auditing sharing processes complete adequate training to fulfil their role.
• maintain staff awareness through materials such as posters, emails, intranet updates, or data sharing content in newsletters.

You should:

• establish the legal basis for each sharing of personal data.
• keep a record of all decisions relating to the sharing of personal data.
• review this record regularly to ensure your decisions are sound and compliant. This also helps identify areas where large amounts of data are routinely shared.
• if data is shared on an ongoing basis, implement appropriate sharing agreements with all third parties, review them regularly, and track them in a sharing agreements register.

You should:

• complete a DPIA before entering into a data sharing agreement to ensure that your company can lawfully share the information and that such sharing complies with data protection legislation requirements.
• regularly review the data sharing agreement to ensure it still reflects the real needs of your company and complies with data protection legislation. Such reviews should establish whether the data is still needed to fulfil the purposes for which it is being shared and whether the agreement reflects current data sharing arrangements.

You must process personal data fairly and lawfully. For processing to be considered fair you must explain to data subjects how their personal data will be used and who it will be shared with. You should include this information in your privacy policy, where you must clearly explain the reasons why you are using the data, including those that involve sharing or disclosing it.

Your company should have appropriate technical and organisational measures in place to protect the personal data you share. It is therefore important to establish and ensure compliance with agreed security levels when sharing personal data. See our information security self-assessment test for tips and advice on how to improve the security of the personal data you hold.

Furthermore, when transferring data between organisations, you should take appropriate measures to ensure its security during transit. This may include using encryption on emails, secure file transfer protocol (SFTP), or a virtual private network (VPN) for digital data. You should similarly have equivalent security for paper documents in transit. Controls could include using a reliable courier or other secure shipping types, lockable containers, or tamper-proof packaging.

You should:

• implement a documented procedure to handle personal data requests efficiently and in compliance with data protection legislation.
• ensure that management has approved this procedure and made it readily available to staff.

You should:

• provide adequate initial training upon or immediately after appointment.
• ensure that all staff receive training updates at regular intervals to maintain adequate levels of awareness.
• use awareness materials such as posters, emails, intranet updates, newsletters.
• provide adequate training to staff with specific responsibilities for processing, logging, or overseeing responses to personal data requests to enable them to perform their role effectively.

You should:

• periodically review your established procedure and, if necessary, update it to ensure it remains adequate and relevant.
• put in place mechanisms for regular checking and analysis of agreed performance measures and apply any recommendations or lessons learned.
• consider the appropriateness of keeping records relating to the activities carried out: management notes, performance indicators, meeting minutes, emails, etc.