The ICO exists to empower you through information.

Navigating the data sharing code

Download options

Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.

Contents

A quick reference guide to help you find the content you need on each topic.

What you need to do or consider		Where you can find it in the data sharing code
Identify your objective in sharing the data		Deciding to share data Data sharing agreements
Be clear as to what data you are sharing		Deciding to share data Data sharing agreements
Understand the position following UK exit from the EU		How is this code affected by the UK’s exit from the European Union?
Consider the benefits and risks of sharing and not sharing		What is the purpose of this code? The benefits of data sharing Deciding to share data
Carry out a Data Protection Impact Assessment (DPIA)		Deciding to share data
Put in place a data sharing agreement		Data sharing agreements Accountability
Ensure you follow the data protection principles		Data protection principles
Check your data sharing is fair and transparent		Fairness and transparency
Identify at least one lawful basis for sharing the data before you start sharing it		What is our lawful basis for sharing? Lawful basis for sharing personal data
Put in place policies and procedures that allow data subjects to exercise their individual rights easily		What about access and individual rights? The rights of individuals Law enforcement processing
Be clear about sharing data under the law enforcement processing provisions of Part 3 DPA 2018, and sharing between the UK GDPR/Part 2 DPA 2018 and Part 3 DPA 2018		Law enforcement processing: Part 3 DPA 2018; and sharing with competent authorities under the UK GDPR and Part 2 DPA 2018
Demonstrate a compelling reason if you are planning to share children’s data, taking account of the best interests of the child		Data sharing and children
Share data in an emergency as is necessary and proportionate. Plan ahead as far as possible		Data sharing in an urgent situation or in an emergency
Document your decisions about the data sharing, evidencing your compliance with data protection law		Accountability Data sharing agreements
Put in place quality checks on the data		What information governance arrangements should we have?
Arrange regular reviews of the data sharing arrangement		When should we review a data sharing arrangement? Accountability
Agree retention periods and make arrangements for secure deletion		Security Accountability