Q&As

Must group companies wishing to share personal data enter into a data processing agreement?

read titleRead full title
Produced in partnership with JP Buckley of DWF LLP
Published on LexisPSL on 21/06/2017

The following Information Law Q&A produced in partnership with JP Buckley of DWF LLP provides comprehensive and up to date legal information covering:

  • Must group companies wishing to share personal data enter into a data processing agreement?
  • Data controller—data controller transfers
  • Data controller—data processor transfers
  • International transfers of personal data

Must group companies wishing to share personal data enter into a data processing agreement?

This Q&A touches on many aspects of the data protection regime. For a background to the regime under the Data Protection Act 1998 (DPA 1998), see: Data protection regime—overview and Practice Notes: Key definitions under the DPA 1998 and Data protection principles under the DPA 1998.

For a discussion of the position under the forthcoming General Data Protection Regulation, Regulation (EU) 2016/679 (the GDPR), see Practice Note: Introduction to the EU GDPR and UK GDPR.

The short answer is ‘yes’, but the form of that agreement will vary depending on what is happening with that data.

Firstly, you would need to establish the purposes of the intended processing. Why is the data intended to be shared, and are the data subjects aware of it? They should be aware either in a privacy policy or fair processing notice (or similar), see Practice Note: Privacy notices and Privacy notices—what information to include—checklist.

Data controller—data controller transfers

Where the data controller collecting the data shares it with other group companies for the receiving group company’s own purposes, this would be a controller to

Popular documents