Data Sharing Agreement Template and How to Draft One (2026)

What is a data sharing agreement, and when do you need one? A data sharing agreement is a contract between two or more parties that sets out how personal or business data will be shared between them: what data, for what purpose, on what legal basis, how it is protected, and what each side may and may not do with it. It is sometimes called a data exchange agreement or, where one party only processes data for another, a data processing agreement. You need one whenever your organisation gives another organisation access to data it holds, or receives data from one. Common cases are sharing customer data with a marketing partner, passing employee data to a payroll provider, exchanging data between group companies, or giving a vendor access to run a service for you. The agreement protects both sides and, in most jurisdictions, is required by data protection law when personal data is involved. This article is general guidance, not legal advice. Data protection law varies by jurisdiction and is changing quickly, so have a qualified professional review any agreement before you rely on it. ## Data sharing agreement template Copy the block below and fill the bracketed fields. ```

DATA SHARING AGREEMENT This Data Sharing Agreement ("Agreement") is made on [DATE] BETWEEN: [PARTY A NAME], [address] ("Discloser") AND [PARTY B NAME], [address] ("Recipient") 1. PURPOSE The parties will share data only for the following purpose(s): [state the specific purpose]. The Recipient will not use the data for any other purpose without the Discloser's written consent. 2. DATA SHARED The data shared is described in Schedule A, which lists the categories of data, the data subjects, the volume, and the format. 3. ROLES For the purposes of applicable data protection law, each party is a [data fiduciary / data controller] in its own right, OR the Recipient acts as a [data processor] processing data only on the Discloser's instructions. [Choose the role that fits; the obligations differ.] 4. LAWFUL BASIS AND CONSENT The Discloser confirms it has a valid lawful basis to share the data, including any required notice to or consent from data subjects. The Recipient will not act outside that basis. 5. SECURITY The Recipient will apply reasonable technical and organisational security measures, including [encryption in transit and at rest, access controls, logging]. The Recipient will restrict access to staff who need it. 6. SUB-PROCESSING AND ONWARD TRANSFER The Recipient will not share the data with any third party or transfer it outside [country/region] without the Discloser's prior written consent and an equivalent level of protection. 7. DATA SUBJECT RIGHTS Each party will help the other respond to requests from data subjects to access, correct, or erase their data, within [N] days. 8. BREACH NOTIFICATION The Recipient will notify the Discloser without undue delay and in any event within [N] hours of becoming aware of any personal data breach, and will cooperate on remediation and any required regulatory notification. 9. RETENTION AND RETURN The Recipient will keep the data only as long as needed for the purpose, and on termination will [return / securely delete] it and confirm in writing. 10. AUDIT The Discloser may audit the Recipient's compliance with this Agreement on [N] days notice, no more than [once a year] unless a breach occurs. 11. LIABILITY AND INDEMNITY Each party is responsible for its own breach of this Agreement and of applicable law, and indemnifies the other for losses its breach causes, subject to the liability cap in clause [__]. 12. TERM, TERMINATION AND GOVERNING LAW This Agreement runs from [START] and either party may end it on [N] days notice or immediately for material breach. It is governed by the laws of [jurisdiction]. Signed for the Discloser: __________ Signed for the Recipient: __________ Name / title / date Name / title / date

- **Roles (clause 3).** Decide whether the parties are independent controllers or whether one processes data for the other. Under India's Digital Personal Data Protection Act, 2023, the party that decides the purpose and means is the data fiduciary, and a party that only processes on its behalf is a data processor; the fiduciary stays responsible even when it uses a processor. Under the EU and UK GDPR the terms are controller and processor. Pick the right role, because the obligations differ.
- **Lawful basis and consent (clause 4).** The disclosing party should confirm it is allowed to share the data, including any notice or consent the law requires.
- **Security and breach (clauses 5 and 8).** Set concrete security measures and a tight breach-notification window, because the disclosing party often has its own regulatory deadline to meet.
- **Onward transfer (clause 6).** Control sub-processing and cross-border transfer. The DPDP Act uses a negative-list approach to overseas transfers, so name the mechanism and check current restrictions. <!-- [VERIFY: DPDP Rules on cross-border transfer and breach timelines; confirm against final Rules] -->
- **Retention and audit (clauses 9 and 10).** Require deletion or return at the end, and keep a right to audit so the duty is real, not just on paper. ## Common mistakes to avoid - Vague or open-ended purpose wording, which undermines the whole agreement.
- Getting the roles wrong, so the wrong party carries the wrong obligations.
- No breach-notification window, leaving the disclosing party exposed to its own regulatory deadlines.
- Ignoring cross-border transfer rules when the recipient or its servers sit abroad.
- No deletion or return duty at the end, so data lingers after the purpose is spent. ## A note on jurisdiction Data protection law varies by jurisdiction, and this is the area where a single template cannot fit everywhere. In India, the Digital Personal Data Protection Act, 2023 governs personal data, with the detailed obligations set out in the DPDP Rules; the fiduciary stays answerable for compliance even when a processor handles the data. In the EU and UK, the GDPR sets controller and processor duties, lawful bases, and strict breach timelines. Singapore has the PDPA, Australia the Privacy Act and its APPs, and the US has a patchwork of state laws such as the CCPA and CPRA. Because the data may move across borders, the safe approach is to require compliance with the law of each place the data is used, and to say "varies by jurisdiction" rather than assume one rule covers all. Last verified October 2026. ## Where a contract workspace helps A template gives you a solid data sharing agreement. The ongoing work is everything after signing: keeping purpose, security and retention terms consistent across many partners, checking each incoming agreement for weak clauses before you sign, remembering audit rights and retention deadlines, and keeping versions straight as your data relationships grow. Drafting a data sharing agreement tuned to how your company handles data, checking an incoming agreement for weak purpose, security or retention terms, editing terms in plain language, and keeping audit rights and retention deadlines in view is the kind of job one AI workspace can hold in a single place, and [Adira](https://adiralaw.com) is one such tool. This template alone is enough to put a fair data sharing agreement in place; one connected place simply keeps drafting, review and tracking together instead of scattered.