Data Controller To Data Controller Agreement Template for England and Wales

When your organization needs to share personal data with another company while both parties maintain independent control over their data processing activities, you need a Data Controller To Data Controller Agreement. This specialized contract ensures compliance with UK data protection laws while establishing clear boundaries and responsibilities for each organization involved in the data sharing arrangement.

When do you need this document?

You should use this agreement whenever your organization plans to regularly share personal data with another independent data controller. This includes situations such as joint marketing initiatives between companies, sharing customer information for enhanced services, business partnerships requiring customer data exchange, or collaborative research projects involving personal information. The agreement is also essential when outsourcing specific functions while retaining joint control over certain data processing activities, or when establishing data sharing relationships with suppliers, distributors, or other business partners who will process shared data for their own purposes.

Key legal considerations

The agreement must clearly define the purpose and scope of data sharing, ensuring both parties have a lawful basis for processing under UK GDPR. You need to specify which data protection principles apply, including data minimization, accuracy, storage limitation, and accountability requirements. Security measures are crucial – the document should outline technical and organizational safeguards that both parties must implement to protect shared personal data. The agreement must address how data subject rights will be handled, including access requests, rectification, erasure, and portability rights. Breach notification procedures are essential, defining how quickly and through what channels each party must inform the other of security incidents. You should also include clear data retention periods, deletion procedures, and termination clauses that specify what happens to shared data when the agreement ends.

Legal requirements in England and Wales

Under English and Welsh law, this agreement must comply with UK GDPR requirements, which diverged from EU GDPR following Brexit. The Data Protection Act 2018 provides additional context for UK-specific obligations that may not be covered in the EU framework. Both parties must ensure they have appropriate lawful bases for processing, which may include legitimate interests, contract performance, or consent depending on the data sharing purpose. The agreement should reference ICO guidance and codes of practice, particularly those relating to data sharing and joint controllers. You must consider the territorial scope of UK GDPR and ensure appropriate safeguards are in place if data will be transferred outside the UK. The document should also address compliance with PECR 2003 if electronic communications or marketing activities are involved. Regular reviews and updates may be necessary to maintain compliance with evolving UK data protection requirements and ICO guidance.