The University may receive requests for personal data from individuals or organisations who are not the data subject. Examples include:
In all these situations there is a legal framework for responding. Please check each request with the data protection team. Even if the requester is stressing the urgency on the phone or in repeated emails, do not panic and request the information be made in writing. Obtaining information about someone by deception or “blagging” is common approach that the ICO often highlights.
The University may wish to share personal data for specific purposes with another organisation or multiple agencies. In these cases, a Data Sharing Agreement, Information Sharing Agreement or Data Sharing Protocol should be set up to define
A template may be provided by another organisation and be acceptable. The following is a University template for these situations:
In all cases consult the data protection officer by emailing firstname.lastname@example.org