When data moves between controllers.
WHEN IT HAPPENS
Referrals to partners Joint marketing Group companies Professional advisers Debt collection
WHAT TO ESTABLISH FIRST
Your lawful basis for sharing.
WHY
Having a basis to hold data does not create a basis to share it.
WHAT TO CHECK
Whether your privacy notice discloses it.
WHAT TO DISCLOSE
The categories of recipient, specifically enough to be meaningful.
WHAT AN AGREEMENT SHOULD COVER
What is shared For what purpose What the recipient may and may not do Security What happens on termination
WHAT TO AVOID
Sharing because a partner asked Sharing more than the purpose requires
WHAT TO ASSESS ABOUT THE RECIPIENT
Whether they will handle it appropriately.
WHY
Your customers will hold you responsible regardless.
WHAT TO NEVER DO
Sell customer data without a clear basis and disclosure.
WHAT TO BE CAREFUL WITH
Group companies, which are separate controllers.
WHY
Being part of one group does not make sharing automatic.
WHAT TO RECORD
Every sharing arrangement, in the inventory.
WHAT TO REVIEW
Whether each is still necessary.
WHAT TO DO ON TERMINATION
Confirm deletion by the recipient.
