Data sharing request

Structured record for a request to receive or disclose personal data with another organisation. Complete the sections, then download a PDF for your file or use Print. Northbrik Systems Ltd provides this as a convenience only; it is not legal advice. Internal questions: legal@northbrik.com.

For the organisation documenting the sharing request. Fields are guidance only; add or remove in your own templates as your DPO advises.

Requesting organisation

Organisation name

Legal entity that is party to the sharing.

Registered or principal address

Company / charity number (if applicable)

Other organisation

The counterparty you are sharing with or receiving from (not the same as "requesting organisation" if you are recording one side only, adjust labels to match your process).

Organisation name

Key contact (name, role, email)

Person completing this form

Full name

Role / position

Work email

Phone (optional)

Request timing & governance

Internal reference / ticket ID (optional)

Date of request

Date data is required by

Timing notes, dependencies, or milestones

e.g. project phase, contract start, statutory deadline.

DPO or privacy lead consulted: how, when, outcome; or why not yet

Personal data

Categories of data subjects

e.g. staff, customers, patients, pupils, claimants. Be specific enough to assess fairness and risk.

Description of data, including categories of personal data

List fields or datasets; omit or pseudonymise where you would not put full detail in a service provider form.

Estimated volume / scale

e.g. number of records, % of population, frequency of feed.

Special category, criminal offence, or other sensitive processing (DPA 2018 Part 3)

State yes/no and which condition and considerations apply, or "Not applicable".

Children’s data involved (and age range if yes)

Controller relationship

Joint controllersSeparate controllersNot specified

Further detail on controller arrangements (optional)

Purpose, lawfulness & recipients

Specific purpose of sharing

Lawful basis under UK GDPR Article 6 (and why it applies)

Article 9 / Schedule 1 DPA 2018 condition (if applicable)

Recipients or categories of recipient

Who will receive the data beyond the named organisation, if anyone (processors, sub-processors, professional advisers).

Data sharing agreement: status; if none, rationale and compensating controls

International transfers & safeguards

Will personal data leave the UK (or be accessed from outside the UK)?

Include cloud regions, overseas parents, support desks, and remote access.

Safeguards (encryption, access controls, IDTA / SCCs, adequacy, etc.)

Retention, risks & DPIA

Retention periods and secure deletion / return of data

Main risks to individuals if something goes wrong

Mitigations or residual risk

DPIA status

DPIA reference, link, or register ID

Short summary of DPIA outcome

Sign-off (optional)

Prepared by

Reviewed by (e.g. DPO)

Sign-off date

Reference: UK GDPR and Data Protection Act 2018; ICO accountability and data sharing guidance. Product: Northbrik.