DRAFTING FOR BREXIT: For the latest information on the impact of Brexit on the drafting, negotiation and enforceability of this Precedent, see Practice Notes: Brexit—implications for data protection, Brexit—drafting boilerplate clauses and Brexit—drafting commercial clauses. [In this Agreement:] Applicable Law means as applicable and binding on the Customer, the Supplier and/or the Services: (a) any law, statute, regulation, byelaw or subordinate legislation in force from time to time to which a party is subject and/or in any jurisdiction that the Services are provided to or in respect of; (b) the common law and laws of equity as applicable to the parties from time to time; (c) any binding court order, judgment or decree; or (d) any applicable direction, policy, rule or order that is binding on a party and that is made or given by any regulatory body having jurisdiction over a party or any of that party’s assets, resources or business; Appropriate Safeguards means such legally enforceable mechanism(s) for Transfers of Personal Data as may be permitted under Data Protection Laws from time to time; Controller has the meaning given to that

Defined terms: In addition to the definitions below, this Precedent also uses the defined terms ‘Agreement’, ‘Business Day’, ‘Customer’, ‘party’ / ‘parties’, ‘Services’ and ‘Supplier’, which are not specific to data processing and which it is assumed are separately defined in the relevant agreement. See the drafting notes for further guidance. The Schedule 1 Definitions and interpretation 1.1 In this Schedule: Adequacy Regulation • means any valid adequacy regulation as referred to in Article 45A of the GDPR; Attached Standard Contractual Clauses • means the provisions set out in [Annex [insert] to ] Appendix 7; Binding Corporate Rules • means the binding corporate rules referred to in Appendix 6; Controller • has the meaning given in Data Protection Laws; Data Protection Impact Assessment • shall be construed in accordance with Data Protection Laws; Data Protection Laws • means all applicable laws relating to the processing, privacy, and/or use of Personal Data, as applicable to either party or the Services, including: (a) the GDPR; (b) the Data Protection Act 2018; (c) any laws which implement or supplement any such laws; and (d) any laws which replace, extend, re-enact, consolidate or amend any of the foregoing; Data Protection Supervisory Authority • means [any regulator, authority or body responsible

This Precedent uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are not specific to data processing and which it is assumed are separately defined in the relevant agreement. The Schedule Part A: Operative provisions 1 Definitions 1.1 In this Schedule: Applicable EEA Law • means all applicable law(s) of the European Economic Area and European Union and of the relevant member state(s) of either; Applicable UK Law • means all applicable law(s) of the United Kingdom (or of any part of the United Kingdom); Controller • has the meaning given in applicable Data Protection Laws from time to time; Data Protection Laws • means all applicable law relating to the processing, privacy and/or use of Personal Data, as applicable to either party or the Services, including: (a) the EU GDPR; (b) the UK GDPR and the UK DPA 2018; (c) any laws which implement or supplement any such laws; and (d) any laws that replace, extend, re-enact, consolidate or amend any of the foregoing; Data Protection Supervisory Authority • means any regulator, authority or body responsible for administering Data Protection Laws; Data Subject • has the meaning given in applicable Data Protection Laws from

This Precedent uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Charges’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are not specific to data processing and which it is assumed are separately defined in the relevant agreement. The Schedule Part A: Operative provisions 1 Definitions 1.1 In this Schedule: Controller • has the meaning given in applicable Data Protection Laws from time to time; Data Protection Laws • means, as binding on either party or the Services: (a) the EU GDPR; (b) the UK GDPR and the UK DPA 2018; (c) any laws which implement or supplement any such laws; and (d) any laws that replace, extend, re-enact, consolidate or amend any of the foregoing; Data Subject • has the meaning given in applicable Data Protection Laws from time to time; EEA Data Protection Laws • means Data Protection Laws applicable under the laws of the European Economic Area, the European Union or any of their member states; EEA Protected Data • has the meaning given in paragraph 4.2 of this Part A; EU GDPR • means the General Data Protection Regulation, Regulation (EU) 2016/679; GDPR • means the EU GDPR and UK GDPR (as applicable in the circumstances); Personal Data • has the meaning given in applicable Data

This Precedent is drafted in contemplation of arrangements where the parties wish to insert data processing provisions within a Schedule rather than as clauses in the main body of the agreement, for example due to the length of legally compliant provisions. It is based on Precedent: Personal data processing clause—short-form—pro-controller. It uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are not specific to data processing and which it is assumed are separately defined in the relevant agreement. The Schedule Part A: Operative provisions 1 Definitions 1.1 In this Schedule: applicable law • means applicable law of the United Kingdom (or of a part of the United Kingdom); Controller • has the meaning given in applicable Data Protection Laws from time to time; Data Protection Laws • means all applicable law relating to the processing, privacy and/or use of Personal Data, as applicable to either party or the Services, including: (a) the GDPR; (b) the Data Protection Act 2018; (c) any laws that supplement, replace, extend, re-enact, consolidate or amend any of the foregoing; and (d) [all guidance, guidelines and codes of practice issued by any relevant Data Protection Supervisory Authority

This Precedent is drafted in contemplation of arrangements where the parties wish to insert data processing provisions within a Schedule rather than as clauses in the main body of the agreement, for example due to the length of compliant provisions. It is based on Precedent: Personal data processing clause—short-form—pro-processor. This schedule uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Charges’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are not specific to data processing and which it is assumed are separately defined in the relevant agreement. The Schedule Part A: Operative provisions 1 Definitions 1.1 In this Schedule: applicable law • means applicable law of the United Kingdom (or of a part of the United Kingdom); Controller • has the meaning given in applicable Data Protection Laws from time to time; Data Protection Laws • means, as binding on either party or the Services: (a) the GDPR; (b) the Data Protection Act 2018; and (c) any laws that supplement, replace, extend, re-enact, consolidate or amend any of the foregoing; Data Subject • has the meaning given in applicable Data Protection Laws from time to time; GDPR • means the General Data Protection Regulation, Regulation (EU) 2016/679, as it forms part of domestic law in

This Agreement is made on [date] Parties 1 [insert name of disclosing party] [of OR a company incorporated in [England and Wales] under number [insert registered number] whose registered office is at] [insert address] (Disclosing Party), and 2 [insert name of receiving party] [of OR a company incorporated in [England and Wales] under number [insert registered number] whose registered office is at] [insert address] (Receiving Party), (each of the Disclosing Party and the Receiving Party being a party and together the Disclosing Party and the Receiving Party are the parties). Background (A) The parties have identified a requirement to share the Shared Data for the Permitted Purpose. (B) The parties have decided to create a framework for the [systematic OR ad-hoc OR one-off] sharing of the Shared Data, which is likely to require sharing of the Shared Personal Data. (C) The Disclosing Party considers that it may share the Shared Personal Data with the Receiving Party on the legal basis of the Permitted Lawful Basis. (D) [The parties have completed a data protection impact assessment in respect of the planned sharing of the Shared Personal Data under this Agreement,

This Practice Note explores issues and best practice relating to the sharing of personal data between controllers (including joint controllers and independent controllers) in general business-to-business commercial situations under the requirements of the United Kingdom General Data Protection Regulation, Assimilated Regulation (EU) 2016/679 (UK GDPR). It assumes a degree of familiarity with key data protection concepts and terms and the role of the Information Commission’s Office (ICO). For a higher-level introduction to this topic and related issues, see: Data sharing and transactions—overview. For a higher-level introduction to UK data protection laws generally, see Practice Note: Data protection law—new starter guide. The UK data protection law collection collates further general guidance, including guidance on key terms used in the legislation, and is a recommended starting point for data protection research. In brief—summary of steps controllers should often take before data sharing The UK GDPR regime seeks to ensure information about living individuals (within the definition of ‘personal data’) is used fairly and responsibly. One of the key protections under the regime is the set of obligations

Defined terms: This Precedent clause uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Disclosing Party’, ‘parties’, ‘person’ and ‘Receiving Party’, which are not specific to data processing and which it is assumed are separately defined (or will be adapted) as appropriate in the relevant agreement. It is assumed that references to ‘Disclosing Party’ and ‘Receiving Party’ will be conformed as appropriate to reflect the relevant defined term for each party used in the agreement in which this clause is used. 1 Data protection 1.1 In this clause 1: Communication • means a complaint, request or other communication (but excluding any Data Subject Request) relating to either party’s obligations under any Data Protection Laws in connection with this Agreement and/or the processing of any of the Shared Personal Data, including any compensation claim from a Data Subject or any notice, investigation or other action from a Data Protection Supervisory Authority relating to the foregoing (and Communicator means the Data Protection Supervisory Authority, Data Subject or other person initiating or conducting a Communication); Consent • means a freely given, specific, informed and

Defined terms: This precedent schedule uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Disclosing Party’, ‘parties’, ‘person’ and ‘Receiving Party’, which are not specific to data processing and which it is assumed are separately defined (or will be adapted) as appropriate in the relevant agreement. It is assumed that references to ‘Disclosing Party’ and ‘Receiving Party’ will be conformed as appropriate to reflect the relevant defined term for each party used in the agreement in which this schedule is used. The ScheduleSharing Personal Data 1 Definitions and interpretation 1.1 In this Schedule: Communication • means a complaint, request or other communication (but excluding any Data Subject Request) relating to either party’s obligations under any Data Protection Laws in connection with this Agreement and/or the processing of any of the Shared Personal Data, including any compensation claim from a Data Subject or any notice, investigation or other action from a Data Protection Supervisory Authority relating to the foregoing (and Communicator means the Data Protection Supervisory Authority, Data Subject or other person initiating or conducting a Communication); Controller • has the meaning given in applicable Data

The ScheduleJoint controller arrangements 1 Definitions and interpretation 1.1 In this Schedule: Communication • means a complaint, enquiry, notice, request or other communication (but excluding any Data Subject Request) relating to either party’s obligations under any Data Protection Laws in connection with this Agreement and/or the Processing of any of the Shared Personal Data, including any compensation claim from a Data Subject or any notice, investigation or other action from a Data Protection Supervisory Authority relating to any of the foregoing; Consent • means a freely given, specific, informed and unambiguous indication (by a statement or by a clear affirmative action) by which the relevant Data Subject has agreed to the relevant disclosure(s) and/or Processing of the Shared Personal Data relating to them that has not been withdrawn. To the extent the relevant Shared Personal Data is Special Category Personal Data, this definition should be read as if the word ‘unambiguous’ above read ‘unambiguous and explicit’. The terms freely given, specific, informed, unambiguous and explicit in this definition shall be construed in accordance with Data Protection Laws; Contact Point • means,

This precedent is for use between a processor and sub-processor and assumes the customer (as the original processor) is seeking to flow down terms agreed with a controller entity based on Precedent: Personal data processing schedule—pro-customer—UK GDPR and EU GDPR. For a list of precedent provisions for use between a controller and processor, see: List of data protection clauses and agreements for commercial transactions and personal data processing and sharing. This precedent uses the additional defined terms ‘Agreement’, ‘Business Day’, ‘Customer’, ‘Services’, ‘Supplier’ and ‘Supplier Personnel’, which are unlikely to be specific to this schedule and which it is assumed are separately defined in the relevant agreement. The Schedule Part A: Operative provisions 1 Definitions 1.1 In this Schedule: Applicable EEA Law • means all applicable law(s) of the European Economic Area and European Union and of the relevant member state(s) of either; Applicable UK Law • means all applicable law(s) of the United Kingdom (or of any part of the United Kingdom); Controller • has the meaning given in applicable Data Protection Laws from time to time; Controller Entity • means