Explore UCD

UCD Home >

Data Sharing

Data Sharing

What are UCD’s legal responsibilities when sharing data?
Whenever people provide personal data to the university, the university takes on the legal responsibility for this data’s data protection  compliance. A responsibility that also extends to the sharing of the data with other organisations. Any sharing of UCD data with outside organisations by Schools/Units, including by their research or administrative projects, requires agreements on behalf of UCD as data controller.

View (opens in a new window)UCD's Short Guide on Data Sharing and Collaborating* for further guidance. 

Agreements and Contracts

If you share data with external organisations, depending on the relationship they have with you/your organisation/UCD, different types of agreements and contracts are required: 

    1.  UCD has control over the purposes and means of processing and shares the personal data with another organisation that also has control over the data for the same purpose, then a joint controller agreement needs to be drawn up. This agreement needs to detail roles and responsibilities, including individuals whose personal data are shared.
    2. UCD has control over the purpose and means of processing and shares the personal data with another organisation that also has control over the data but for a different purpose, then a data sharing agreement is required.
    3. UCD as controller shares personal data with a service provider or outsources activities to a third party, which acts as a processor. In such a scenario, a controller - processor contract/data processing agreement is mandatory. UCD needs to provide detailed instructions to the processor and the processor would only be allowed to further share the personal data if UCD gives detailed written permission to do so. 

Please contact UCD Legal should you require an agreement. 

(* documents are available via the UCD Connect log-on to UCD Staff and Faculty members)