A Data Sharing Agreement is a contract that documents what data is being shared and how it can be used. It can be used to make data sharing lawful.
To lawfully use a processor or a sub-processor the controller or the processor must have a data sharing agreement (DSA) in place. A DSA must clearly document what data that can be processed. Meaning, the contract should prevent processing activities such as data sharing to be unknown.
The DSA can make data sharing between two entities lawful. Furthermore, you can use a DSA to share data between different parts of an organisation. You can also use the basis for a DSA to regulate the responsibilities in a situation of joint controllership.
For each Data Sharing Agreement you will have to consider at least the following:
- what type of data will you share;
- how is the relationship between the parties;
- each party’s insight into the other party’s activities; and
- does the sharing include transfers to a third country.