The ICO says that its new Data Sharing Code of Practice, which is a statutory code made under s 121 of the Data Protection Act 2018, provides practical advice to businesses and organisations on how to carry out responsible data sharing.

The Code addresses many aspects of the GDPR and the 2018 Act, including transparency, lawful bases for using personal data, the new accountability principle and the requirement to record processing activities. It has been submitted to the Secretary of State who will then lay it before Parliament. It will come into force 21 days following approval.

On 31 December 2020, a UK version of the GDPR will be written into UK law (UK GDPR) to sit alongside the 2018 Act. References in the code to the GDPR should be read as references to the equivalent provision in the UK GDPR.

Alongside the code, the ICO has launched a data sharing information hub where organisations can find targeted support and resources, including:

• data sharing myths busted;
• data sharing code: the basics for small organisations and businesses;
• data sharing FAQs for small organisations and businesses;
• case studies;
• data sharing checklists;
• data sharing request and decision forms template;
• sharing personal data with a law enforcement authority toolkit;
• guidance on sharing personal data with law enforcement authorities; and
• guidance on data sharing and reuse of data by competent authorities for non-law enforcement purposes.

As part of its ongoing work, the ICO is encouraging organisations that are developing products and services that support complex data sharing in the public interest to apply for its regulatory Sandbox.

The ICO also says that it will also increase its engagement with organisations to help them understand the code and promote the benefits of sharing data. To read the ICO’s statement in full and for a link to the code and the new information hub, click here.