Mae'r ICO yn bodoli i'ch grymuso chi drwy gyfrwng gwybodaeth.

Navigating the data sharing code

The Data (Use and Access) Act 2026 got Royal Assent on 19 June 2026. All the provisions affecting data protection law and the Privacy and Electronic Regulations Communications are now in force. The Department for Science and Innovation (DSIT) has set out the commencement plans. You can find more details on the Gov.uk website.

Contents

A quick reference guide to help you find the content you need on each topic.

What you need to do or consider →	Where you can find it in the data sharing code
Identify your objective in sharing the data →	Deciding to share data Data sharing agreements
Be clear as to what data you are sharing →	Deciding to share data Data sharing agreements
Understand the position following UK exit from the EU →	How is this code affected by the UK’s exit from the European Union?
Consider the benefits and risks of sharing and not sharing →	What is the purpose of this code? The benefits of data sharing Deciding to share data
Carry out a Data Protection Impact Assessment (DPIA) →	Deciding to share data
Put in place a data sharing agreement →	Data sharing agreements Accountability
Ensure you follow the data protection principles →	Data protection principles
Check your data sharing is fair and transparent →	Fairness and transparency
Identify at least one lawful basis for sharing the data before you start sharing it →	What is our lawful basis for sharing? Lawful basis for sharing personal data
Put in place policies and procedures that allow data subjects to exercise their individual rights easily →	What about access and individual rights? The rights of individuals Law enforcement processing
Be clear about sharing data under the law enforcement processing provisions of Part 3 DPA 2018, and sharing between the UK GDPR/Part 2 DPA 2018 and Part 3 DPA 2018 →	Law enforcement processing: Part 3 DPA 2018; and sharing with competent authorities under the UK GDPR and Part 2 DPA 2018
Demonstrate a compelling reason if you are planning to share children’s data, taking account of the best interests of the child →	Data sharing and children
Share data in an emergency as is necessary and proportionate. Plan ahead as far as possible →	Data sharing in an urgent situation or in an emergency
Document your decisions about the data sharing, evidencing your compliance with data protection law →	Accountability Data sharing agreements
Put in place quality checks on the data →	What information governance arrangements should we have?
Arrange regular reviews of the data sharing arrangement →	When should we review a data sharing arrangement? Accountability
Agree retention periods and make arrangements for secure deletion →	Security Accountability