There are two legal mechanisms for clarifying roles, responsibilities and expectations in data transfer with third parties: the RGPD is much less prescriptive when it comes to sharing with controllers in relation to processor transmissions, it will probably take some time before the practice is settled. Is common use between unrelated parties or between related companies? The OIC provides instructions for data exchange at /ico.org.uk/media/for-organisations/documents/1068/data_sharing_code_of_practice.pdf. This document has not yet been updated to reflect the RGPD, but it remains a useful guide. For more details, you can read the ProtonMail data processing agreement or the generic model of data processing agreements that we have made available on this site. 8. The data protection impact analysis and the data protection subcontractor provide the company with appropriate support for all data protection impact assessments and prior consultations with supervisory authorities or other data protection authorities; that the company considers reasonably necessary in accordance with section 35 or 36 of the RGPD or equivalent provisions of another data protection law, in any case only with respect to the processing of the company`s personal data by contract processors and taking into account the nature of the processing and information available to processors. To address these and other relevant issues, the RGPD stresses the need for data exchange agreements. If you are passing personal data on to third parties, whether as the person in charge of the common pilot or to an independent third party, you will need a legitimate reason for processing personal data in this way. It is possible to share data on the legitimate stoltogen interest of treatment, but you must make an assessment of legitimate interests very carefully to ensure legality – and of course, store them if you are ever challenged. Any information subject to a legal period of preservation must be destroyed in accordance with the law. All other organizations with a copy must also delete them in accordance with the statutes. These requirements must be included in the contract/share.