As a business, implementing a data sharing agreement can be a good practice when sharing personal data with other parties. Before getting started, you should make sure to understand what this agreement is and why it can be useful for your business in ensuring compliance, security, and trust with your partners and customers.

👀 In this article, we explain everything that you should know about data sharing agreements, why and in what cases they can be useful. We also look at the difference with another document, the data processing agreement. Let’s get started!

📌 What is a Data Sharing Agreement?

As the name implies, a data sharing agreement may be defined as a legally-binding document or agreement, between two or more entities, which regulates how data is shared among these parties and for what purpose.

A data sharing agreement or DSA clearly defines the roles, responsibilities, and rights of all parties involved in the data exchange process.

The types of data shared may be of various types:

• data about identified or identifiable natural persons or “personal data“;
• data protected by intellectual property rights or another kind of property-like right;
• data considered confidential (including trade secrets and know-how), financial data, etc.

💡 The parties to the DSA are bound to comply with obligations at two levels: mandatory rules arising from the applicable law(s); and terms and conditions of the contract itself, agreed by the parties.

When is it Useful?

Data sharing agreements are especially valuable when it comes to data transfers that involve a high amount of data, or data that is quite sensitive (e.g. confidential data).

They are typically used for data transfers between government agencies, for example, or in the big data industry.

In fact, big data requires a multitude and complexity of factors, data sources, flows, algorithms… For carrying safe and compliant analytics activities, it’s a good starting point to have the right agreements in place.

📌 What are the Components of a Data Sharing Agreement?

A well-structured data sharing agreement should, at least, contain the following elements:

1. Definition of parties: clearly identify all parties involved in the data sharing process. This includes the data owner (the entity providing the data), the data recipient (the entity receiving the data), and any third parties involved.
2. Purpose of data sharing and legal basis: articulate why the data is being shared, e.g. for data analysis, for the implementation of a new program or service…
3. Categories of data to be shared: specify the types and categories of data being shared (e.g. name, address, phone number). You can also mention subject’s rights as per the GDPR.
4. Function of the parties: define the function of the party disclosing and the party receiving data, in relation to their purpose.
5. Processing details: description of how data will be processed (e.g. information is sent via a secure file transfer, then stored). Mention duration and frequency.
6. Security measures: detail the security measures in place to protect the data during transmission and storage. These include password protection, the use of unique identifiers, procedures for handling data breaches, data encryption, staff training, and data backup, including backups for VMware in virtualized environments.
7. Retention and deletion: specify for how long the data will be kept before it is deleted.
8. Withdrawal and termination: define the various procedures and specify how the agreement can be ended and what happens to the data after termination.

💡 Looking to use a template? A template data sharing agreement can help you get started, but always remember to tailor the agreement to your specific situation and seek professional legal advice to ensure all bases are covered.

📌 Data Sharing Agreement vs. Data Processing Agreement

Unlike data sharing agreements, data processing agreements are required under the GDPR (Article 28).

When you, as a data controller, need an external supplier to help process personal data, this “supplier”, referred to as a processor by the GDPR, will handle your client data on your behalf, not for their own interest.

According to Article 28 of the GDPR, a written “Data Processing Agreement” must be established between the data controllers and data processors.

This agreement outlines each party’s responsibilities, like:

• following instructions from controllers;
• implementing sufficient data protection measures; and
• cooperating with controllers in response to user queries or actions by regulatory bodies.

💡 Controllers and processors are jointly liable to third parties. This means, if an individual believes their data has been illegally processed, they can demand compensation from either the controller or processor. The party that compensated can later seek reimbursement from the other party.

See also

• GDPR Data Storage: What Businesses Need to Know
• Data Discovery and Privacy Laws: What you Need to Know
• GDPR data mapping explained and why it is important
• Data Retention Policy: Best Practices And Why You Need One