Suppliers cannot relocate personal data without the consent of the processing manager. Agreements need to be reassessed and re-evaluated to include downstream transformers when needed. There are 4 common types of sharing that can be initiated by a controller. “responsible,” the individual or corporation, the public authority, the agency or any other agency that, alone or in conjunction with others, determines the purposes and means of processing personal data; Where the purposes and means of this treatment are determined by EU law or By Member State law, the person responsible for the treatment or the specific criteria for appointing it can be provided for by EU law or by Member State law; Data governance teams play an important role in establishing data exchange agreements. They ensure that legal and compliance teams opt out of one country to another, from an organisation to a supplier and from a supplier to a downstream processor before any transfer of personal data belonging to an EU citizen. Before thinking about another aspect of a data exchange agreement, you should define the role of the party making the transfer: is it a manager or a subcontractor with respect to shared personal data? Note that the details of these agreements may have to reconcile differences in management with differences in business practices. For example, how does an agency protect its data and what access can it allow through firewalls and security checks? How will agencies inform each other if authorizations are changed? Which manager will be responsible for the specified data? Terms of access: Whether the data is online or not, the agreement must determine who has what rights to access the data, who has what rights to modify or modify the data, and what methods apply to accessing the data. Is common use between unrelated parties or between related companies? Since the RGPD is much less prescriptive when it comes to sharing with controllers than for transfers to processors, it will probably take some time for the practice to be regulated. Below, you`ll find a list of items that are usually included in a data sharing agreement. While this list may cover the databases, additional concerns may be relevant to a data set or supplier agency.