The Data Sharing Code of Practice, which is a statutory code made under s 121 of the Data Protection Act 2018, was first published by the ICO in December 2020. It came into force on 5 October 2021.

The ICO says that the Code provides practical advice to businesses and organisations on how to carry out responsible data sharing. It addresses many aspects of the GDPR and the 2018 Act, including transparency, lawful bases for using personal data, the accountability principle and the requirement to record processing activities. It also dispels many of the myths around data sharing.

The ICO also has a “data sharing information hub” on its website where organisations can find targeted support and resources, including:

• data sharing myths busted;
• data sharing code: the basics for small organisations and businesses;
• data sharing FAQs for small organisations and businesses;
• case studies;
• data sharing checklists;
• data sharing request and decision forms template;
• sharing personal data with a law enforcement authority toolkit;
• guidance on sharing personal data with law enforcement authorities; and
• guidance on data sharing and reuse of data by competent authorities for non-law enforcement purposes.

The ICO says that data sharing must engender trust in how personal data is used in order to drive innovation, economic growth and the delivery of more efficient and targeted services. In the ICO’s view, data sharing will be central to the UK’s recovery from the COVID-19 pandemic. To access the Code on the ICO data sharing information hub, click here.