So the sharing of thoroughly anonymised data is not subject to any restrictions. information about living identifiable individuals. Remember that these restrictions and conditions only apply where the sharing involves personal data – i.e. This is to ensure that the personal data are protected adequately and handled properly by others. The UK GDPR sets certain restrictions and conditions when the University shares personal data with third party organisations. Templates are published and/or available on request as described below. Sharing outside the UK: if the country has not been declared 'adequate' by the UK Government, then a transfer risk assessment should be carried out and standard contractual clauses should normally be used. The sharing is done as securely as appropriate for the data involved.įor some sorts of sharing, contracts or other agreements are required. The sharing is for the minimum time and it is clear what then happens to the data. The minimum amount of personal data is shared. The individuals have been made aware their data is being shared. to meet a contractual obligation or pursue a research project). There is a good reason for the sharing to take place (e.g. Sharing personal data must comply with the data protection principles.

The restrictions only apply to sharing personal data, that is information about living identifiable individuals (and not, for example, anonymised data).Ī joint data controller (for joint purposes).Īnother data controller (a third party for their own use).Ī data processor engaged to store or use data for the University. Sharing that involves a transfer of personal data outside the UK – additional restrictions and conditions Summary General points to bear in mind in advance of sharing personal dataĬategory 1: Sharing personal data with a third party for joint purposes – core restrictions and conditionsĬategory 2: Sharing personal data with a third party for its own purposes – core restrictions and conditionsĬategory 3: Using a data processor: sharing personal data with a third party for it to store or use on behalf of the University – core restrictions and conditions What different layers of restrictions and conditions are there? What categories of data sharing are there?

Personal data examples