Data sharing

Summary

This is guidance from Guernsey's Office of the Data Protection Authority explaining what data sharing is and how controllers can share personal data lawfully and appropriately. It is informational guidance rather than a binding rule, aimed at helping controllers balance the benefits of sharing data against the risks to individuals.

• What data sharing is: Giving or making personal data available to other controllers to enable collaboration, avoid duplication and support better outcomes.
• Law as enabler: The Data Protection Law is framed as facilitating fair and proportionate data sharing rather than blocking it, provided sharing is approached appropriately.
• Risk assessment: Controllers are advised to assess risks using a Data Protection Impact Assessment (DPIA) before sharing data.
• Data sharing agreements: It is described as good practice, though not mandatory, to put a data sharing agreement in place before sharing personal data.
• Scope limitation: The Law, and this guidance, only applies where the sharing involves personal data relating to identified or identifiable living individuals.

The guidance does not impose new legal duties beyond the existing requirement to comply with the Law when personal data is involved, but sets out recommended practices (DPIA, data sharing agreements) for lawful and proportionate sharing.

Key obligations

• Controllers must comply with the Data Protection Law whenever a data sharing activity involves personal data of identified or identifiable living individuals.

Applies to

controllers