Last updated: 13 August 2025

On this page

If your business shares personal data with other organisations, you can’t just send it over and hope for the best — the UK GDPR and Data Protection Act 2018 (DPA 2018) set out strict rules you must follow. These apply whether you’re sharing data inside the UK or sending it overseas.

For some businesses, the EU GDPR may still apply alongside the UK GDPR — for example, if you have operations in the EU, offer goods or services to EU customers, or monitor the behaviour of people in the EU.

1) What is data sharing?

Data sharing means giving personal data to another organisation or person. This could be:

  • Routine sharing – e.g., providing customer details to a delivery partner.
  • One-off sharing – e.g., sending information to prevent fraud.
  • Ongoing arrangements – e.g., two businesses pooling data for a joint project.

It does not include giving employees access to data as part of their job, or using an IT supplier purely as a processor — those are covered by different rules.

2) The ICO’s 2021 Data Sharing Code of Practice

The Information Commissioner’s Office (ICO) publishes the Data Sharing Code of Practice to help organisations share personal data in a way that is fair, lawful and transparent. The current version (2021) is a statutory code: the ICO can refer to it when assessing compliance. It doesn’t create new law, but explains how to meet existing duties under the UK GDPR and DPA 2018 (and, where relevant, EU GDPR).

Core themes:

  • Data protection is an enabler — share responsibly, not recklessly.
  • Accountability — document how and why you decided to share.
  • Plan before you share — identify benefits/risks and whether a Data Protection Impact Assessment (DPIA) is needed.
  • Use written agreements — set out roles, purposes, security and rights handling.
  • Be transparent — tell people what you’re doing and why.

Why follow the Code? It builds trust, reduces legal/reputational risk, and provides strong evidence of compliance if challenged.

3) Professional guidance & voluntary industry codes

Your sector may have professional guidance or voluntary codes (e.g., NHS/Caldicott in healthcare, FCA expectations in financial services, DMA Code in marketing, DfE/Jisc in education). These aren’t a substitute for GDPR compliance but they:

  • Provide sector-specific best practice that often goes beyond the legal minimum.
  • Demonstrate accountability and support a strong privacy culture.
  • Increase trust with customers and regulators.

Where available, consider joining an approved code of conduct (Article 40 UK/EU GDPR) as further evidence of compliance.

4) Key GDPR principles for sharing

  1. Lawfulness, fairness & transparency — have a lawful basis and explain clearly.
  2. Purpose limitation — only share for the reason you collected it.
  3. Data minimisation — share the minimum necessary.
  4. Accuracy — keep data correct and up to date.
  5. Storage limitation — don’t keep data longer than needed.
  6. Integrity & confidentiality (security) — protect data during and after transfer.

These principles apply under both UK GDPR and, where applicable, EU GDPR.

5) Main risks for controllers in data sharing

  • Incompatible purpose — sharing for a use that’s inconsistent with the original purpose breaches the purpose limitation principle (e.g., using delivery data for unrelated marketing without consent).
  • No lawful basis — if you share without a valid legal ground, the sharing is unlawful regardless of security measures.
  • Security failures — weak controls (unencrypted emails, poor access control) can cause breaches.
  • No DPIA when required — if sharing is likely to result in high risk (e.g., large-scale special category data), a Data Protection Impact Assessment is mandatory.
  • Unclear responsibilities — without a robust written agreement, disputes and liability are more likely.

Mitigate these risks with clear agreements, DPIAs, strong technical/organisational measures, and accurate records of decision-making.

6) Controller vs Processor (and why it matters)

Controller — the decision-maker

Decides why and how personal data is processed; chooses the lawful basis; provides privacy information; ultimately responsible for compliance (UK GDPR and, where relevant, EU GDPR).

Processor — the service provider

Processes data on behalf of a controller under written instructions; must keep data secure and assist the controller with compliance; cannot decide the purposes.

ICO guidance: what to include in data sharing agreements

Controller ↔ Controller (recommended):

  • Purpose of sharing and lawful basis.
  • Data categories shared and minimisation measures.
  • Security (transfer, storage, access control, encryption).
  • Retention & deletion/return mechanics.
  • Individuals’ rights — who handles requests and how.
  • Breach handling & notification between parties and to the ICO.
  • Review/audit schedule and governance contacts.

Controller ↔ Processor (mandatory under Article 28 UK/EU GDPR):

  • Processor acts only on documented instructions.
  • Confidentiality and appropriate security obligations.
  • Sub-processor controls and flow-down terms.
  • Assistance with rights requests, DPIAs and breach notification.
  • Return/deletion of personal data at contract end and audit rights.

7) Lawful bases for sharing

You must identify a lawful basis, such as:

  • Consent (clear, specific, unambiguous, and withdrawable).
  • Legal obligation.
  • Performance of a contract.
  • Legitimate interests (with a documented balancing test).

Special category or criminal offence data needs additional conditions. If EU GDPR applies to your activities, you must meet the lawful-basis rules in both regimes.

8) International data transfers (SCCs, BCRs & TRAs/TIAs)

If you send personal data outside the UK, UK GDPR’s transfer rules apply. If you’re also subject to EU GDPR, you must meet the EU’s transfer rules as well.

  • Adequacy decisions — transfer to countries approved as providing adequate protection.
  • Appropriate safeguards (no adequacy):

Standard Contractual Clauses (SCCs)

  • ICO/EU-approved template clauses inserted into contracts with overseas recipients.
  • Bind both parties to GDPR-level protections even if local laws are weaker.
  • UK and EU have separate SCCs — organisations subject to both may need to use both sets.

Binding Corporate Rules (BCRs)

  • Internal privacy rules for multinational groups enabling intra-group transfers.
  • Require prior approval by the ICO (UK) or an EU supervisory authority (EU).
  • Best suited to organisations with frequent intra-group transfers.

Transfer Risk Assessments (TRAs) / Transfer Impact Assessments (TIAs)

  • Assess before relying on SCCs/BCRs whether destination-country laws/practices could undermine protections (e.g., surveillance, lack of redress).
  • Under UK GDPR: the ICO provides a TRA tool. Under EU GDPR: perform a TIA (similar concept).
  • Document findings and apply supplementary measures where needed (e.g., strong encryption, data minimisation).

Be transparent: tell individuals which country data goes to, the safeguards used, and that you completed a TRA/TIA where relevant.

9) Transparency & privacy notices

Provide clear, plain-language privacy information covering: who you are, why you’re sharing and with whom, whether data goes overseas (UK/EU/EEA or beyond) and the protections used, how to exercise rights, and how to complain (ICO and, if applicable, an EU regulator). These often come in the form of a Privacy Policy. We can help with this.

10) Security & accountability

  • Use secure transfer methods (e.g., encryption, access control, audit trails).
  • Carry out DPIAs where risk is high and implement mitigations.
  • Complete TRAs/TIAs for international transfers as required.
  • Maintain records of processing and decisions to evidence compliance (accountability).

11) Fines & enforcement

Under UK GDPR:

  • Up to £17.5m or 4% of global annual turnover (whichever is higher) for serious infringements.
  • Up to £8.7m or 2% of global annual turnover for other infringements.

Under EU GDPR (if applicable): up to €20m or 4%, or €10m or 2% depending on the infringement. Beyond fines, expect enforcement notices, orders to stop processing, potential claims, and reputational harm.

Bottom line

Sharing personal data can be essential for business, but it brings serious responsibilities. Follow the ICO’s Data Sharing Code, align with professional guidance and voluntary codes, nail your roles and agreements, apply the GDPR principles, and take extra care with international transfers — including SCCs, BCRs, and TRAs/TIAs. We can help with all of this. Get in touch for a free consultation.

This article is general guidance and not legal advice. Always seek advice tailored to your organisation and data flows.

Published by Fergus Thompson