How to review a data sharing agreement under UK data protection law

A data sharing agreement sets the rules when one organisation shares personal data with another that will use it for its own purposes. It is different from a data processing agreement, which governs a processor acting on a controller's instructions. This checklist covers what to check under the UK GDPR, the Data Protection Act 2018 and the changes made by the Data (Use and Access) Act 2025, and how to review the agreement in Word with LexDraft.

Last checked: 17 October 2026. The law changes; check the current position before relying on this page.

The legal framework

• Is an agreement required? The ICO says a data sharing agreement between controllers is not mandatory, but it is good practice. Joint controllers, by contrast, must have an arrangement under Article 26 of the UK GDPR setting out their responsibilities, and a controller using a processor needs an Article 28 contract.
• The ICO data sharing code. The ICO's data sharing code of practice is a statutory code under section 121 of the Data Protection Act 2018 and has been in force since 5 October 2021. The ICO says it is under review because of the Data (Use and Access) Act 2025, so check for an updated version.
• The Data (Use and Access) Act 2025. The Act received Royal Assent on 19 June 2025 and is being commenced in stages. From 5 February 2026 it added "recognised legitimate interests" as a lawful basis (Article 6(1)(ea)) for listed purposes such as safeguarding, crime prevention and responding to emergencies, and new rules on when further processing is compatible with the original purpose (Article 8A). From 19 June 2026 controllers must have a process for handling data protection complaints.

Clause checklist

• Parties and roles. Name each party and say whether they are independent controllers or joint controllers. If one party acts only on the other's instructions, you need a processing agreement instead. See our UK GDPR DPA guide.
• Purpose. A specific purpose for the sharing, and limits on using the data for anything else. Check any further use against the compatibility rules.
• Data. The categories of personal data and data subjects, including any special category or criminal offence data, and why each item is needed (data minimisation).
• Lawful basis. The basis each party relies on, including any condition for special category data. If a party relies on recognised legitimate interests, check that the purpose is on the statutory list.
• Transparency. Who tells data subjects about the sharing, and how privacy notices are updated.
• Data quality and retention. Accuracy, how corrections are passed on, retention periods and secure deletion.
• Security. Technical and organisational measures, access controls and secure transfer methods.
• Individual rights and complaints. How access, rectification and erasure requests and complaints are handled and passed between the parties, and the timescales.
• Personal data breaches. Notice between the parties fast enough for each controller to meet the 72-hour deadline for reporting to the ICO where required.
• International transfers. Whether either party sends data outside the UK, and the transfer mechanism used.
• Review and termination. Regular review of the sharing, and what happens to the data when the agreement ends.

Review the data sharing agreement in Word with LexDraft

1. Open the data sharing agreement in Word, open LexDraft from the Home tab and set the jurisdiction chip to UK: England & Wales (or UK: Scotland or UK: Northern Ireland if that is the governing law).
2. Run the quick checks. They are rule-based and run without AI, catching undefined or unused defined terms, broken cross-references, numbering gaps and inconsistent capitalisation.
3. Run the review. The DPA playbook is built for controller-to-processor terms, so use it for any processing terms in the agreement; controller-to-controller sharing terms run as a general review, because LexDraft has no dedicated data sharing agreement playbook. Findings are graded Critical, High, Medium or Low, and LexDraft flags standard terms that are missing.
4. Accept or reject each proposed redline. Accepted edits land as native Word tracked changes, ready for the other side.
5. Ask the Assistant to explain a clause in plain English or suggest wording for your side. Answers use UK spelling.
6. Look up any case you want to rely on in the Case law tab, then open the judgment on Find Case Law and read it yourself. UK judgments in LexDraft come from The National Archives' Find Case Law service, which only partially represents the activities of the courts and tribunals. Not every judgment or decision is included. Find Case Law does not include judgments from Scottish or Northern Irish courts or tribunals.

LexDraft does not give legal advice and does not summarise judgments. AI output can be wrong, so qualified counsel must check every redline before it goes out.

Common mistakes

• Labelling a party a processor when it decides how and why the data is used.
• No purpose limitation, so the receiving party can reuse the data for anything.
• Using "Shared Data", "Personal Data" and "Data" inconsistently. The defined-term check catches this.

This guide is general information, not legal advice. LexDraft does not give legal advice; qualified counsel must review every draft. LexDraft is not affiliated with or endorsed by The National Archives or any court. Spotted something out of date? Email support@lexdraft.ai and we will fix it.