Data agreements
Data sharing agreement
The paper for two organisations exchanging data where neither is simply processing on the other's instructions. Each side decides things about the data it receives, which makes it a different animal from a processing addendum. It names the datasets, the purpose the exchange serves, how the data moves, what each side may and may not do with it, and how long each keeps it. Where personal information is involved, it also records what each side tells the people concerned.
- In the catalogue
- Data agreements
- Where it can live
- Any of the 184 governing laws
Who uses one
- Partners running a joint programme, study or integration.
- Companies exchanging customer or operational data under a commercial arrangement.
- Organisations sharing datasets with researchers or public bodies.
What you are deciding
- Which datasets are shared, and in which direction
- The purpose the sharing serves, stated narrowly
- What each side may do with what it receives
- How the data moves, and how it is secured in transit and at rest
- Whether the data may be combined with other sources
- How long each side keeps it, and what happens at the end
- Who answers questions from the people the data is about
- What happens if there is an incident on either side
Blanks you leave stay blank and wait in the room. Nothing is filled in from a guess.
The sections a draft usually has
- 1The parties
- 2The data being shared
- 3Purpose of the sharing
- 4Roles and responsibilities
- 5Permitted and prohibited uses
- 6Security and transfer method
- 7Individual rights and transparency
- 8Retention and deletion
- 9Incidents
- 10Term and termination
A general outline, not a required one. What turns up in a draft follows what you described. A contract is written in the order a contract is read.
What people call it
The names this kind of paper goes by. They are here because people search for them. They also filter the catalogue. They are not a wordlist the door matches. At the composer you describe the deal in your own words instead.
- data sharing agreement
- data exchange agreement
- joint controller agreement
- data transfer agreement
- information sharing agreement
- dataset licence agreement
Questions people ask
- How is this different from a processing addendum?
- A processing addendum has one side acting on the other's instructions. A data sharing agreement has both sides making their own decisions about the data they hold, which changes what each has to do.
- Does anonymised data need an agreement?
- Often it still does, because the terms of use, re-identification risk and onward sharing all need settling — even where privacy rules apply differently to data that no longer identifies anyone.
- Who tells the people the data is about?
- Papers of this kind allocate it, usually to the side with the existing relationship. Leaving it unallocated is a common gap, and it is the sort of thing regulators ask about.
General answers about the document. Not advice about your situation. Not written about any one country.
Where it lives
A contract names the legal system it is governed by. That is a separate decision from which paper it is. You pick it at the door, from any of the 184 units in Governing law, including England and Wales, Delaware, California and New York.
You do not start from this page. Describe the deal in one sentence at the door. Read the draft back in plain language, in the order a contract is read.
Start it at the door →Related kinds