A Data Processing Agreement fits a processor acting on your instructions. Where the other organisation uses the data for its own purposes it is a separate controller, and the document that fits is a…
Two businesses sharing personal data often reach for the wrong document. They sign a Data Processing Agreement when what they actually have is a controller-to-controller relationship that calls for a Data Sharing Agreement. The two are not interchangeable. Here is how to tell them apart and what the right one covers.
UK GDPR draws a hard line between two relationships.
A processor handles personal data only on the controller's documented instructions and for the controller's purposes: a payroll bureau, a cloud host, an email platform. That relationship is governed by Article 28 UK GDPR, and Article 28(3) prescribes a binding written contract with mandatory terms: a Data Processing Agreement (DPA).
A controller decides for itself why and how it processes the data. When one organisation shares personal data with another that then uses it for its own purposes (a referral partner who markets to the people introduced, a group company running its own analysis, a project partner pursuing its own aims), the recipient is a separate controller, not a processor. This is data sharing between controllers, and it is a different document: a Data Sharing Agreement (DSA).
The practical test: once the other organisation has the data, does it follow the first organisation's instructions (processor, needs a DPA) or make its own decisions (controller, a DSA fits)?
Article 28(3) is prescriptive for processors: it lists what the contract must contain. For sharing between separate controllers, UK GDPR prescribes no contract. The framework is the data protection principles in Article 5, each controller's own lawful basis under Article 6, the purpose-limitation rules in Article 8A for the controller that collected the data, and the statutory Data Sharing Code of Practice issued under section 121 of the Data Protection Act 2018.
The Code was issued by the Information Commissioner. Since 30 September 2026 the regulator is the Information Commission (Data (Use and Access) Act 2025, sections 118 and 119, commenced by S.I. 2026/1015), which keeps the abbreviation ICO, and anything done by the Commissioner is treated as done by the Commission (S.I. 2026/1015, regulation 3), so the Code continues in force. Its legal effect is set by section 127 of the 2018 Act: a failure to follow the Code does not of itself make anyone liable to proceedings; the Code is admissible in evidence; a court or tribunal must take a relevant provision of it into account; and so must the Commission when exercising its functions under the data protection legislation and the Privacy and Electronic Communications Regulations 2003.
A written agreement is not mandatory between separate controllers, but the Code treats one as good practice, and for joint controllers (below) a transparent arrangement is required by Article 26.
This is the fork that changes the document.
Separate (independent) controllers each decide their own purposes and means for the data, and each is independently responsible for its own processing. Most commercial data sharing is this kind: one party passes data to a partner, and from that point each runs its own processing.
Joint controllers jointly determine the purposes and means of the processing. Where that is the case, Article 26 UK GDPR applies and is mandatory: the parties must, in a transparent manner, determine their respective responsibilities for compliance, in particular for the exercise of data subjects' rights and for providing the information required by Articles 13 and 14, by means of an arrangement between them (Article 26(1)). The arrangement must reflect the parties' respective roles and relationships towards data subjects, and its essence must be made available to them (Article 26(2)), usually through each party's privacy notice. Whatever the parties agree between themselves, a data subject may exercise their rights against each controller (Article 26(3)).
Getting this wrong matters: drafting a joint-controller arrangement as if the parties were independent (or vice versa) misstates who is accountable to the individuals whose data it is.
In a processor relationship the processor acts under the controller's lawful basis. In controller-to-controller sharing there is no borrowing: each controller needs its own Article 6 lawful basis for its own processing, and an Article 9 condition for any special category data such as health information.
Legitimate interests now comes in two forms. Under Article 6(1)(f) the processing must be necessary for the legitimate interests of the controller or a third party, and those interests must not be overridden by the interests, rights and freedoms of the data subject: the balancing test. Article 6(11), inserted by the Data (Use and Access) Act 2025, gives three examples of processing that may fall within (f): direct marketing, intra-group transmission of personal data where necessary for internal administrative purposes, and ensuring the security of network and information systems. Since 5 February 2026 there is also Article 6(1)(ea), recognised legitimate interests, which applies only where a condition in Annex 1 is met (disclosure to another person at its request for a public-interest task, national security and defence, emergencies, crime, and safeguarding vulnerable individuals) and carries no balancing test (Data (Use and Access) Act 2025, section 70 and Schedule 4; S.I. 2026/82). Neither (ea) nor (f) is available to a public authority performing its tasks. Most commercial sharing falls under (f), so the balancing test still applies to it.
The disclosing controller has a further question. Sharing data for a purpose other than the one it was collected for is further processing, and Article 5(1)(b) requires the new purpose to be compatible with the original. Article 8A sets out the factors for that assessment and the cases treated as compatible, including the Annex 2 conditions, several of which concern disclosures made in response to a request. The data subjects also need to have been told, under Articles 13 and 14, that their data is or may be shared and with whom.
The Data Sharing Code lists what a controller-to-controller agreement should record: whether the parties share as separate or joint controllers; a clear data specification (what categories of data, whose data, for what permitted purpose, and in which direction); each party's own lawful basis; how data subjects are informed and how their rights are handled; security measures and how the data is transferred securely; breach notification between the parties; international transfers where data leaves the UK; and retention and deletion. For joint controllers it also allocates the Article 26 responsibilities and records that the essence of the arrangement will be shared with data subjects.
The Information Commission's published version of the Data Sharing Code carries a notice, read on 4 October 2026, that the guidance is under review because of the changes made by the Data (Use and Access) Act 2025. The controller and processor distinction, the Article 26 joint-controller duties and the Article 28 contract requirements are in the statute and are not changed by that review; the Code's practical guidance may be.
Termsmith generates controller-to-controller Data Sharing Agreements, separate or joint controller, for £9.99. If the other organisation only processes data on your instructions, the document that fits is a Data Processing Agreement, which Termsmith also generates.
This article provides general information about UK data protection law as read at source on 4 October 2026. It is not legal advice.
Loading interactive view…