Why English? | Writing an Information Sharing Agreement Through Purpose, Parties, Data, Authority, Security, Access, Retention, Incidents, Rights and Review

ORIENTATION

What this guide covers

Current fact check

Checked on 8 November 2026, the PDPC guidance library included current data management, third-party and cross-border transfer resources alongside its Guide to Data Sharing. Current ICO guidance stated that sharing agreements should clarify parties, purpose, data lifecycle, roles, security, access, retention, incidents, rights, review and termination, while not removing each party's legal responsibility.

What this guide does not cover

This article covers an information sharing agreement for planned recurring sharing between organisations. It does not cover one-off emergency disclosure, legal power, consent wording, privacy notice, data processing agreement, cross-border transfer assessment, cybersecurity architecture, research ethics approval or final authorisation.

Worked example

Every chapter returns to a fictional education provider and community partner coordinating optional learner-support referrals with explicit boundaries. It is fictional, low-stakes and educational; it does not report a real school, clinical decision or guaranteed outcome.

Warm up with eduKate’s guides to explaining scientific evidence and asking better questions in class.

CHAPTER 1 OF 15

1. Define the Purpose and Expected Benefit

Back to contents

Why this move matters

State the specific aim, affected people and public or individual benefit.

Define a necessary and lawful sharing purpose

State the specific aim, affected people and public or individual benefit. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, The partners want to make optional support referrals easier to complete. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

A beneficial aim does not automatically make sharing necessary or lawful. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Define the Purpose and Expected Benefit”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 2 OF 15

2. Test Necessity and Proportionality

Back to contents

Why this move matters

Explain why the aim requires sharing and consider less intrusive alternatives.

Define a necessary and lawful sharing purpose

Explain why the aim requires sharing and consider less intrusive alternatives. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, The team compares full case transfer with a learner-led referral token. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Convenience alone may not justify broad data sharing. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Test Necessity and Proportionality”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 3 OF 15

3. Identify Parties, Roles and Contacts

Back to contents

Why this move matters

Name organisations, legal roles, accountable owners, operational contacts and recipients.

Define a necessary and lawful sharing purpose

Name organisations, legal roles, accountable owners, operational contacts and recipients. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, The provider initiates referrals while the partner independently manages accepted cases. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Role labels depend on actual facts and law, not preferred wording. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Identify Parties, Roles and Contacts”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 4 OF 15

4. Record Authority, Conditions and Prohibitions

Back to contents

Why this move matters

Document applicable powers, obligations, lawful basis, confidentiality and prohibited uses for specialist review.

Define a necessary and lawful sharing purpose

Document applicable powers, obligations, lawful basis, confidentiality and prohibited uses for specialist review. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, The agreement forbids marketing use and requires authorised support purposes only. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

The agreement cannot create a legal power that does not exist. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Record Authority, Conditions and Prohibitions”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 5 OF 15

5. Define the Data and Minimum Fields

Back to contents

Why this move matters

List exact data elements, categories, sensitivity, frequency and data minimisation reasons.

Define a necessary and lawful sharing purpose

List exact data elements, categories, sensitivity, frequency and data minimisation reasons. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, A referral uses contact details, chosen support need and consent record, not an entire learner file. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

A field may become identifying when combined with other data. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Define the Data and Minimum Fields”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 6 OF 15

6. Set Accuracy, Format and Quality Rules

Back to contents

Why this move matters

Define source, validation, coding, corrections, timestamps and quality responsibilities.

Define a necessary and lawful sharing purpose

Define source, validation, coding, corrections, timestamps and quality responsibilities. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Partners use common referral statuses and correct errors through a named route. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Standard format does not guarantee factual accuracy. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Set Accuracy, Format and Quality Rules”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 7 OF 15

7. Design Secure Transfer and Authentication

Back to contents

Why this move matters

Specify approved channels, encryption, recipient checks, authentication, logging and failed-transfer handling.

Define a necessary and lawful sharing purpose

Specify approved channels, encryption, recipient checks, authentication, logging and failed-transfer handling. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, The system verifies the partner account before encrypted transfer. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Encryption does not fix an incorrect recipient or excessive data. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Design Secure Transfer and Authentication”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 8 OF 15

8. Restrict Access and Secondary Use

Back to contents

Why this move matters

Define authorised roles, least privilege, onward sharing, matching, analytics and audit.

Define a necessary and lawful sharing purpose

Define authorised roles, least privilege, onward sharing, matching, analytics and audit. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Only support coordinators access referrals and may not reuse them for promotion. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Role-based access needs regular review as staff move. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Restrict Access and Secondary Use”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 9 OF 15

9. Plan Transparency and Individual Choice

Back to contents

Why this move matters

Explain notices, consent where relevant, accessible language, withdrawal limits and support routes.

Define a necessary and lawful sharing purpose

Explain notices, consent where relevant, accessible language, withdrawal limits and support routes. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Learners see what will be shared, with whom, why and what happens next. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

Consent is not always the correct authority and must not be assumed. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Plan Transparency and Individual Choice”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 10 OF 15

10. Handle Rights, Queries and Complaints

Back to contents

Why this move matters

Allocate responsibilities, identity checks, response coordination, corrections and escalation.

Define a necessary and lawful sharing purpose

Allocate responsibilities, identity checks, response coordination, corrections and escalation. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, A learner can ask either partner how a referral record is used. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

An agreement should not make individuals navigate organisational disputes. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Handle Rights, Queries and Complaints”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 11 OF 15

11. Set Retention, Return and Deletion

Back to contents

Why this move matters

Define triggers, periods, holds, disposal evidence, backups and different legal duties.

Define a necessary and lawful sharing purpose

Define triggers, periods, holds, disposal evidence, backups and different legal duties. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Unaccepted referrals are deleted after a verified period while accepted cases follow the partner's authorised rule. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

One party's schedule may not lawfully bind another. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Set Retention, Return and Deletion”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 12 OF 15

12. Coordinate Incidents and Breaches

Back to contents

Why this move matters

Set detection, containment, notification, evidence preservation, roles, timing and communication.

Define a necessary and lawful sharing purpose

Set detection, containment, notification, evidence preservation, roles, timing and communication. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, A misdirected referral triggers immediate contact, containment and joint assessment. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

The agreement cannot predetermine every regulatory conclusion. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Coordinate Incidents and Breaches”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 13 OF 15

13. Monitor Compliance and Effectiveness

Back to contents

Why this move matters

Define logs, sampling, access reviews, quality measures, outcomes and assurance rights.

Define a necessary and lawful sharing purpose

Define logs, sampling, access reviews, quality measures, outcomes and assurance rights. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Quarterly review checks referral accuracy, access, rejected transfers and learner experience. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

High referral volume does not prove the arrangement is beneficial. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Monitor Compliance and Effectiveness”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 14 OF 15

14. Control Changes, Suspension and Termination

Back to contents

Why this move matters

Set approval for new fields, purposes, parties or systems and define stop, return or deletion routes.

Define a necessary and lawful sharing purpose

Set approval for new fields, purposes, parties or systems and define stop, return or deletion routes. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, A proposed analytics use pauses until purpose and safeguards are reassessed. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

A contract end does not automatically remove every copy. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Control Changes, Suspension and Termination”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

CHAPTER 15 OF 15

15. Review the Agreement and Document Decisions

Back to contents

Why this move matters

Set cadence, owners, evidence, amendments, version dates and decisions to continue or stop.

Define a necessary and lawful sharing purpose

Set cadence, owners, evidence, amendments, version dates and decisions to continue or stop. Name the parties, people affected, expected benefit, authority, necessity and prohibited secondary uses.

Trace the information at every stage

In the fictional arrangement, Annual review tests necessity, law, incidents, performance and affected-group feedback. Follow selection, transfer, receipt, access, matching, use, retention, deletion and termination.

Write safeguards people can operate

Specify data fields, channels, recipients, authentication, training, audit, incident handling, rights requests and decision records.

Review purpose, performance and exit

A signed agreement can become stale while practice changes. Set review dates, change controls, suspension, return or deletion steps and evidence so the agreement does not outlive its justification.

Student, parent and career transfer

Make one evidence card for “Review the Agreement and Document Decisions”: source location, plain-language meaning, limit and next question. A parent or teacher can ask for one everyday explanation and one specialist explanation; both must preserve the same conditions. This habit supports privacy, education administration, information governance, partnerships, legal operations, cybersecurity, social services, research and programme management without promising a grade, admission, funding decision or job.

PRACTICE LAB

Build a information sharing agreement decision trail

Student route

1. Choose one original report inside this guide’s scope.
2. Copy its objective and underline actor, action, context, evidence and intended decision.
3. Draw the specific reasoning chain used in this article.
4. Mark each step reported, inferred, contested or unknown.
5. Rewrite the conclusion so it preserves the narrowest important limitation.

Parent or teacher route

Ask the learner to explain turn a wish to share information into a precise, accountable agreement about why, what, who, how, how long and what happens when things change twice: once to a classmate and once to a method specialist. Praise a precise correction and a well-stated unknown; both show disciplined attention to evidence.

Early-career route

Create a one-page information sharing agreement audit with source link, date checked, scope, method logic, decisive wording, contrary evidence, limit and next action. A colleague should be able to continue without guessing.

Continue with eduKate’s guides to reading course and career information and giving useful feedback in group projects.

USEFUL NEXT READING

Connect this narrow owner to its neighbour

Read the information-asset-register guide for a related but different reader job. Return here when the question is specifically how to turn a wish to share information into a precise, accountable agreement about why, what, who, how, how long and what happens when things change. Use each guide for the reader task named in its heading.

For English practice across research, school and career communication, visit the Singapore English Tuition Centre learning site.

FREQUENTLY ASKED QUESTIONS

Questions students and parents often ask

Is an information sharing agreement always legally required?

Requirements vary. It is often good practice, but obtain current specialist advice for the actual arrangement.

Does signing make sharing lawful?

No. Each party still needs valid authority, purpose, safeguards and accountability.

Should the agreement list exact fields?

Yes, where practical, so minimisation, quality and access can be assessed.

What is onward sharing?

Disclosure by a receiving party to another recipient; define whether and when it is permitted.

Can partners use different retention periods?

Possibly, where their duties differ, but the agreement should explain and coordinate the consequences.

When should sharing stop?

When purpose, necessity, authority, safeguards or acceptable risk no longer holds, or termination rules apply.