There is no set format for a data sharing agreement. It can take a variety of forms, depending on the scale and complexity of the processing, the ICO says.

“The updated draft code of practice will explain and advise on changes to data protection legislation where these changes are relevant to data sharing. It will address many aspects of the new legislation including transparency, lawful bases for processing, the new accountability principle and the requirement to record processing activities,” the ICO says.

The code discusses legitimate basis, transparency, security and accountability when sharing personal data, as well as individual rights. Under Article 14 of the GDPR, organisations must provide privacy information to individuals whose data has been shared with an organisation “within a reasonable period after obtaining the personal data, but at the latest within one month.”