When is data sharing agreement MOST likely to be needed?

A data sharing agreement is a contract that documents what data is being shared and how it can be

used. It can be used to make data sharing lawful and to demonstrate compliance with the

accountability principle under the GDPR. A data sharing agreement is most likely to be needed when

personal data is being shared between commercial organizations acting as joint data controllers,

because they have to determine and agree on their respective roles and responsibilities, such as the

purpose and legal basis of the data sharing, the rights of the data subjects, the security measures,

and the liability for any breaches. A data sharing agreement is not mandatory, but it is good practice

and can help to avoid disputes and confusion. A data sharing agreement may not be needed or may

be less detailed in the other scenarios, depending on the circumstances and the nature of the data.

For example, anonymized data is not personal data under the GDPR and does not require a data

sharing agreement, although it may still be subject to other contractual or ethical obligations.

Personal data that is proactively shared by a controller to support a police investigation may be

covered by a legal obligation or a public interest, and the controller may not have much control over

how the data is used by the police. Personal data that is shared with a public authority with powers

to require the personal data to be disclosed may also be subject to a legal obligation or a public

interest, and the controller may have to comply with the authority’s request without a data sharing

agreement. Reference:

Data sharing agreements | ICO, which provides guidance on the benefits and contents of a data

sharing agreement.

Data Sharing Agreement - the Definition - GDPR Summary, which explains what a data sharing

agreement is and when it can be used.

The role of data sharing and the GDPR | Data Republic, which discusses the impact of the GDPR on

data sharing practices.