Data sharing agreements
These agreements facilitate the lawful sharing of personal data between two controllers (as that term is defined in the General Data Protection Regulation). They can be used with respect to joint controllers or independent controllers. They are not however suitable for use in relation to controller-to-processor or processor-to-processor sharing.
Data sharing agreement (mutual)
Buy | |
Version | 1.3 |
---|---|
First published | 31 May 2018 |
Last updated | 31 May 2023 |
Word count | 6,942 |
Template pages | 15 |
Data sharing agreement (unilateral)
Buy | |
Version | 1.0 |
---|---|
First published | 31 May 2023 |
Last updated | 1 Jun 2023 |
Word count | 6,267 |
Template pages | 13 |
Compare contents
Data sharing agreement (mutual) contents
- Definitions: definitions; data protection terms.
- Term: commencement of term; end of term.
- Obligations to share Personal Data: obligation on First Partyto share personal data; obligation onSecond Partyto share personal data.
- Data quality: parties to ensure data quality.
- No special categories: no special categories of personal data to be shared; no criminal conviction data to be shared.
- Parties acting as controllers: each party is independent controller of shared personal data; legal bases of sharing personal data (independent controllers); document does not apply to all personal data.
- Parties acting as controllers: parties are joint controllers of shared personal data; purposes of processing shared personal data (joint controllers); legal bases of sharing personal data (joint controllers); document does not apply to all personal data.
- Compliance with
Data Protection Laws : compliance with data protection laws with respect to shared personal data; shared personal data collected in accordance with law; requirements relating to consent-based processing of personal data;First Partyresponsible for meeting data protection transparency requirements;Second Partyresponsible for meeting data protection transparency requirements; assistance in relation to compliance with data protection laws. - Further disclosure of First PartyPersonal Data:First Partymust not disclose personal data;Second Partymust not disclose personal data; obligations on disclosure ofFirst Partypersonal data; section does not prevent disclosure of anonymised data; section does not prevent disclosure of personal data to processors.
- International transfers of
Shared Personal Data : prohibition on third country transfers of shared personal data; exceptions to prohibition on third country transfers of shared personal data; approved international transfer clauses take precedence overAgreement. Shared Personal Data and supervisory authorities: communications from supervisory authorities about shared personal data; cooperation in relation to supervisory authority action.- Shared Personal Data and data subject rights: communications from data subjects about shared personal data; cooperation in relation to data subject rights; primary data subject contact for joint controllers.
- Security of
Shared Personal Data : appropriate measures to secure shared personal data; particular security measures for shared personal data. - Data breaches involving Shared Personal Data: notification of data breaches involving shared personal data; assistance in relation to shared personal data breaches.
- Retention and deletion: retention periods for First Partypersonal data; retention periods forSecond Partypersonal data; section subject to effects of termination.
- Compliance audit: right to audit compliance; notice of audit; cooperation in relation to audit; costs of licence audit; limits on audit right.
- Changes to
Data Protection Laws : changes to data protection law. - Confidentiality obligations: First Partyconfidentiality undertaking;Second Partyconfidentiality undertaking; disclosure of confidential information to certain persons; exceptions to confidentiality obligations; disclosures of confidential information mandated by law etc; confidentiality obligations after termination.
- Warranties: first party warranty of authority; second party warranty of authority; exclusion of implied warranties and representations.
- Indemnities: First PartyindemnifiesSecond Partyupon breach;Second PartyindemnifiesFirst Partyupon breach.
- Limitations and exclusions of liability: caveats to limits of liability; interpretation of limits of liability; no liability for force majeure; per event liability cap.
- Termination: termination by either party without cause; termination by either party upon breach; termination upon insolvency.
- Effects of termination: parties to delete shared personal data; surviving provisions upon termination; termination does not affect accrued rights.
- Notices: methods and deemed receipt of contractual notices; contact details for contractual notices; substitute contact details for notices.
- Data protection contacts: First Partydata protection contact;Second Partydata protection contact.
- General: no waiver; severability; variation written and signed; no assignment without written consent; no third party rights; entire agreement; governing law; exclusive jurisdiction.
- Interpretation: statutory references; section headings not affecting interpretation; no ejusdem generis.
SCHEDULE 1 (DATA PROTECTION INFORMATION NOTICES)
- First Partydata protection information notice: prompt forFirst Partydata protection information notice.
- Second Partydata protection information notice: prompt forSecond Partydata protection information notice.
SCHEDULE 2 (INTERNATIONAL TRANSFER CLAUSES)
- Prompt for international transfer clauses.
SCHEDULE 3 (FORM OF CONSENT)
- First Partyform of consent: prompt forFirst Partyform of consent.
- Second Partyform of consent: prompt forSecond Partyform of consent.
SCHEDULE 4 (SECURITY MEASURES)
- First Partysecurity measures: prompt for details ofFirst Partysecurity measures.
- Second Partysecurity measures: prompt for details ofSecond Partysecurity measures.
Data sharing agreement (unilateral) contents
- Definitions: definitions; data protection terms.
- Term: commencement of term; end of term.
- Obligations to share
Personal Data : obligation onSharerto share personal data. - Data quality: Sharerto ensure data quality.
- No special categories: no special categories of personal data to be shared by Sharer; no criminal conviction data to be shared by first party.
- Parties acting as controllers: each party is independent controller of first party personal data; legal bases of sharing Sharerpersonal data (independent controllers); document does not apply to all personal data disclosed bySharer.
- Parties acting as controllers: parties are joint controllers of Sharerpersonal data; purposes of processingSharerpersonal data (joint controllers); legal bases of sharing first party personal data (joint controllers); document does not apply to all personal data disclosed bySharer.
- Compliance with
Data Protection Laws : compliance with data protection laws with respect toSharerpersonal data;Sharerpersonal data collected in accordance with law; requirements relating to consent-based processing of personal data;Sharerresponsible for meeting data protection transparency requirements; assistance in relation to compliance with data protection laws. - Further disclosure of SharerPersonal Data:Sharermust not disclose personal data;Recipientmust not disclose personal data; obligations on disclosure ofSharerpersonal data; section does not prevent disclosure of anonymised data; section does not prevent disclosure of personal data to processors.
- International transfers of
: prohibition on third country transfers ofSharerPersonal DataSharerpersonal data; exceptions to prohibition on third country transfers ofSharerpersonal data; approved international transfer clauses take precedence overAgreement. and supervisory authorities: communications from supervisory authorities aboutSharerPersonal DataSharerpersonal data; cooperation in relation to supervisory authority action. and data subject rights: communications from data subjects about first party personal data; cooperation in relation to data subject rights; primary data subject contact for joint controllers.SharerPersonal Data- Security of
: appropriate measures to secureSharerPersonal DataSharerpersonal data; particular security measures forSharerpersonal data. - Data breaches involving the SharerPersonal Data: notification of data breaches involvingSharerpersonal data; assistance in relation toSharerpersonal data breaches.
- Retention and deletion: retention periods for Sharerpersonal data; section subject to effects of termination.
- Compliance audit: right to audit compliance; notice of audit; cooperation in relation to audit; costs of licence audit; limits on audit right.
- Changes to
Data Protection Laws : changes to data protection law. - Recipientconfidentiality obligations:Recipientconfidentiality undertaking; disclosure of confidential information byRecipientto certain persons; exceptions toRecipientconfidentiality obligations; disclosures ofSharerconfidential information mandated by law etc;Recipientto stop using confidential information upon termination;Recipientto return or destroy confidential information following termination;Recipientconfidentiality obligations after termination.
- Warranties: first party warranty of authority; second party warranty of authority; exclusion of implied warranties and representations.
- Indemnities: SharerindemnifiesRecipientupon breach;RecipientindemnifiesSharerupon breach.
- Limitations and exclusions of liability: caveats to limits of liability; interpretation of limits of liability; no liability for force majeure; per event liability cap.
- Termination: termination by either party without cause; termination by either party upon breach; termination upon insolvency.
- Effects of termination: Recipientto deleteSharerpersonal data; surviving provisions upon termination; termination does not affect accrued rights.
- Notices: methods and deemed receipt of contractual notices; contact details for contractual notices; substitute contact details for notices.
- Data protection contacts: Sharerdata protection contact;Recipientdata protection contact.
- General: no waiver; severability; variation written and signed; no assignment without written consent; no third party rights; entire agreement; governing law; exclusive jurisdiction.
- Interpretation: statutory references; section headings not affecting interpretation; no ejusdem generis.
SCHEDULE 1 (DATA PROTECTION INFORMATION NOTICE)
- Prompt for
Recipient
data protection information notice.SCHEDULE 2 (FORM OF CONSENT)
- Prompt for
Recipient
form of consent.SCHEDULE 3 (INTERNATIONAL TRANSFER CLAUSES)
- Prompt for international transfer clauses.
SCHEDULE 4 (SECURITY MEASURES)
- Sharersecurity measures: prompt for details ofSharersecurity measures.
- Recipientsecurity measures: prompt for details ofRecipientsecurity measures.