Joint Controller Data Sharing Agreement Template for Singapore

When multiple organizations work together to process personal data, you need a Joint Controller Data Sharing Agreement to establish clear legal responsibilities under Singapore's Personal Data Protection Act 2012. This agreement defines how each party will handle shared personal data while ensuring compliance with PDPA requirements and protecting both organizations from regulatory risks.

When do you need this document?

You require this agreement when your organization jointly determines the purposes and means of processing personal data with another entity. Common scenarios include healthcare providers sharing patient information for treatment coordination, financial institutions collaborating on customer verification, government agencies exchanging citizen data for public services, or companies partnering on marketing campaigns using shared customer databases. The agreement is mandatory under PDPA when both parties have decision-making authority over the data processing activities, rather than one acting as a mere data processor for the other.

Key legal considerations

Your agreement must clearly define each controller's specific responsibilities under the PDPA's Data Protection Provisions. Critical clauses include data security measures that meet PDPA standards, procedures for handling data subject access requests and complaints, breach notification protocols that comply with the Personal Data Protection Regulations 2021, and mechanisms for ensuring lawful basis for processing. You should address data retention periods, deletion procedures, and audit rights to maintain ongoing compliance. The agreement must also specify how you'll handle conflicts between controllers and establish dispute resolution mechanisms. Transfer limitation obligations become crucial if data will be shared across borders, requiring additional safeguards under PDPA.

Legal requirements in Singapore

Under Singapore law, your Joint Controller Data Sharing Agreement must comply with the Personal Data Protection Act 2012 and associated regulations. Each controller remains individually liable for PDPA compliance, meaning you cannot simply delegate responsibility to your partner. The agreement must address the PDPA's consent requirements, ensuring you have appropriate legal basis for sharing personal data. You must implement the Advisory Guidelines on Key Concepts in the PDPA, particularly regarding purpose limitation and data minimization principles. If your arrangement involves ICT systems, incorporate the Guidelines on Data Protection by Design for ICT Systems to ensure technical compliance. The Personal Data Protection Commission expects clear accountability frameworks, so your agreement should demonstrate how both parties will meet their obligations under the Data Protection Provisions while maintaining individual responsibility for regulatory compliance.