Data Sharing

Before personal data/special category data can be shared with a 3rd party (e.g. another University), the University will need to review the proposed arrangement and, if lawful, put in place an appropriate data sharing agreement or contract. Where data is to be shared outside the UK or European Economic Area, additional safeguards will be needed if the organisation is not located in a country or territory that has adequacy status.

Proposed data sharing arrangements relating to research should be directed to the Research and Knowledge Exchange Contracts team. All other proposed data sharing arrangements should be brought to the attention of the University’s Data Protection Officer, dataprotection@york.ac.uk.

Where the University is looking to engage a third-party service provider to process data on its behalf, normal Procurement processes should be followed. Where the University is looking to engage a third-party IT solution, the University’s IT Outsourcing and Cloud Computing Policy must be followed.

For further information on data sharing see the Information Commissioner's data Sharing information hub.