<img src="https://certify.alexametrics.com/atrk.gif?account=b2hlr1ah9W20em" style="display:none" height="1" width="1" alt="">

sharing data under gdpr

Companies share our personal data all the time. Consider the healthcare provider who passes the patient's medical history on to a consultant in readiness for an operation. Or, a finance company who shares data with a credit rating agency to establish creditworthiness.

Of course, both situations may be legitimate but that's not always true, as these examples show:

Therefore, it's always good practice to check first before sharing personal information with third parties.

Follow these 5 steps to stay compliant when sharing data under GDPR:

  1. Consider legitimacy - why are you sharing data in the first place? What are you hoping to achieve? Is it justified? Is the data sharing proportionate? What and how much data will be shared? With whom?
  2. Weigh up the benefits versus the risks - What are the benefits and risks in sharing or not sharing the information? Remember, if there is a high risk to the rights and freedoms of data subjects, conduct a Data Protection or Privacy Impact Assessment
  3. Ascertain whether you have the right to share information - for example, what type of organisation do you work for, what relevant powers or functions does it have, what is the nature of the information you're planning to share (eg is it confidential, especially sensitive, etc), and is there a legal obligation (such as a legal requirement, a court order, a safeguarding duty, etc)
  4. Develop sharing protocols and agreements - is there any sharing protocol or agreement currently in place with the third party? How frequently is information shared with them? What information will you give to data subjects about this? At what point and how will this be communicated? What specific measures (eg encryption) are in place to maintain security?
  5. Keep data up-to-date and accurate - how will you ensure that the data you have shared remains up-to-date and accurate? Who is responsible for doing this (the company doing the sharing or the recipient company)? What arrangements are in place if data subjects want to access it? How long should the data be retained by each party, and what processes are required to ensure it is deleted by all parties when it is no longer needed?

Leave a comment

Tick

eBook: Essential Uncovered

Skillcast Essentials is our best-selling library and there's a reason for that. Essentials library provides comprehensive coverage of the key compliance / conduct issues that companies in the UK face today.

Download now

How to Manage the Compliance Personas in Your Company

Rory has no time for rules, especially the pointless ones that add a lot of work for no apparent benefit. When he encounters such rules, his first thought is to find a work-around. Andy doesn't mind ...

Read More
FCA Compliance News - November 2018

An overview of the most recent and upcoming changes to FCA guidelines for senior managers...   Regulatory Update The last six weeks have been a very busy time for the UK regulators, with both the ...

Read More
Compliance Essentials News - November 2018

This blog is dedicated to bringing you the news that touches the people dimension of regulatory compliance. It's not only about regulations, policies, procedures and systems. It's also about people, ...

Read More
Getting personal: five ways to engage staff with compliance training

It's an on-going struggle for most companies to engage their staff with compliance training. There's a constant stream of new regulations and tweaks to existing ones. And many of these require ...

Read More