Data Sharing
Further information on data sharing is available in 
Section 8 of the Data Protection Code of Practice.
Required Disclosures to Third Parties
The University may be required by legislation, by any rule of law or by the order of a court to disclose an individual's personal data. This document gives a list of examples of third parties who may require disclosure, and the circumstances under which they may do so. Please note that this list is non-exhaustive. A checklist for data sharing is available below, and further guidance is given in Section 8 of the University's Data Protection Code of Practice. If you have any queries, please contact the Information Governance Manager.
Download the Table of Third Parties who can require disclosure of personal data
Environmental Health Officers have powers to obtain information for the purpose of reporting notifiable diseases. A list of notifiable diseases can be downloaded here.
Permitted Disclosures to Third Parties
The University may receive requests to disclose an individual's personal data, which while not required, may be permitted under Data Protection Legislation. This document gives a list of examples of third parties who may request disclosure of personal data, and the circumstances under which such data may be disclosed. Please note that this list is non-exhaustive. A checklist for data sharing is available below, and further guidance is given in Section 8 of the University's Data Protection Code of Practice. If you have any queries, please contact the Information Governance Manager.
Download the Table of Third parties who may request personal data
Internal Data Sharing
External Data Sharing
Sharing personal data externally will require either a contract, data sharing agreement, data processing agreement or a collaboration agreement depending on who the data is being shared with and the purpose. If you do not have any of these in place or it is a new process contact Governance Services for template documents and guidance.
Sharing data without any of the above agreements in place could be, or could lead to, a data breach.
All Processors contracting with the University to process data on behalf of the University (Controller) whether that is by actual transfer of personal data to them or by the provision of systems or services are subject to the University's Data Processing Terms and Conditions. There are various versions dependent on the situation:
Yellow highlighted sections to be included in Data Processing Schedules, Principal Contract and/or procurement documentation.
(this is the responsibility of colleague outsourcing processing, not Procurement or Governance Services)
To be used with the appropriate Data Sharing Agreement
To be used with the completed clauses parts 1 to 3
The
signatory for Edinburgh Napier University must have appropriate powers under
the University’s Schedule of Delegated Financial Authority: Schedule
of Delegated Financial Authority (napier.ac.uk).
How to Share Data
SharePoint should be used for sharing personal data, as this is the most secure method, speak to Information Services for guidance on how to do this.
If you are sharing personal data externally the data must be encrypted and/or password protected.
Ensure you have a data sharing agreement in place and have provided data subjects with an appropriate Privacy Notice.
Guidance on the Contractual Requirements for Transferring Personal Data to External Organisations
This guidance note provides general advice on the issues you need to consider when setting up or managing contracts where you intend to transfer personal information from the University to another organisation. This is to ensure that you do so in a way that complies with the Data Protection legislation.
Download the Guidance on the Contractual Requirements for Transferring Personal Data to External Organisations
Download the larger format flowchart from the Guidance Note
Page last updated 1 August 2022