Data sharing agreement
The arrangement between controllers who share personal data: who does what, who answers the data subject, and what each may do with the data.
How the register reads it
| Also called | joint controller arrangement, information sharing agreement |
|---|---|
| Family | Privacy |
| Document type | Record. The regimes ask for the content, not the label; a line pasted as a standard, procedure, plan or schedule is placed here with the label noted. |
| Folds into | The regimes accept it folded into the data processing agreement; when neither is listed, the gap is counted once, under the parent. |
| Expected owner | The data protection officer or privacy lead. |
| Review cadence | Annual (the register's default: the clauses say planned intervals and on significant change, and do not fix a period). |
| On the gap list when | never on its own: the register recognises it and names the clauses, but no ticked regime lists it as a separate document (its parent, data processing agreement, is). |
| Template | Data sharing agreement template. |
Which standards require it, and what each expects it to contain
2 requiring clauses, 2 regimesShown on a register for the regimes you tick; with none ticked, ISO 27001 is applied. Requirement text drawn from a human-verified compliance corpus under licence: the corpus statement of each clause, not the instrument verbatim.
ISO/IEC 27701:2025
ISO 27701 A.1.2.8 Joint PII controllerWhere the organization is a joint controller, it must determine the respective roles and responsibilities for processing, including privacy and security requirements, transparently and in a contract or similar binding document covering matters such as the purpose of the sharing, the parties, the categories of data shared, the processing operations, the allocation of technical and organizational measures, responsibility in the event of a breach including who notifies and when, retention and disposal terms, liabilities, how obligations to individuals are met and how they can obtain information, and a contact point for individuals.
Common gap: Joint controllership misclassified as a processor relationship, so the wrong contract terms apply
Source: ISO/IEC 27701:2025
GDPR (Regulation (EU) 2016/679)
GDPR Art. 26 Joint controllersWhere two or more controllers jointly determine the purposes and means of processing, determine their respective responsibilities for compliance in a transparent manner by an arrangement between them, unless those responsibilities are already determined by Union or Member State law, covering in particular the exercise of the data subject's rights and each party's duty to provide the Article 13 and 14 information. The arrangement may designate a contact point for data subjects. It must duly reflect the parties' respective roles and relationships towards data subjects, and its essence must be made available to the data subject. Irrespective of the terms of the arrangement, a data subject may exercise their rights in respect of and against each of the controllers.
Common gap: A controller to processor agreement used where the relationship is in substance joint controllership
Source: GDPR (Regulation (EU) 2016/679)
Do this for every document on your list
Paste the list and get this reading for every document at once, with the owner and cadence against each, the clauses quoted, and the documents the regimes expect that the list does not carry. Eight documents free, no account.
Build a register