We want to pass customer data to a partner – how do we do it lawfully?

This is the key question, because everything else depends on it:

If the partner is a processor or a joint controller, see the related answers below. The rest of this page is about an independent controller.

Passing data on is processing, so it needs one of the bases in Article 6(1) GDPR. Most often:

• Consent (point (a)) – the person ticked a box agreeing that their data goes to a named partner.
• Performance of a contract (point (b)) – the transfer is needed for a service the person ordered, e.g. to a courier to deliver goods.
• Legal obligation (point (c)) – the law requires you to give the data to an authority.
• Legitimate interest (point (f)) – after a balancing test. The GDPR does not directly require it in writing, but without a record you cannot prove it (Article 5(2), Article 24(1)).

The partner needs its own basis too: its own processing is also subject to Article 6(1) GDPR.

Then purpose compatibility. Article 5(1)(b) GDPR: data is collected for specified purposes and not further processed in a way incompatible with them. If the new purpose differs and is not based on consent or on such a law, Article 6(4) GDPR requires you to take into account, among other things, five factors:

1. the link between the old and the new purpose;
2. the context in which the data was collected, especially your relationship with the person;
3. the nature of the data – whether it is special-category data or data on criminal convictions;
4. the possible consequences for the person;
5. safeguards, such as encryption or pseudonymisation.

Example: an online shop would like to give buyers' email addresses to a partner so it can send its own offers. Buyers gave their address to make a purchase. The link between the purposes is weak and people do not expect it – the purposes are not compatible. Consent is needed.

Data minimisation (Article 5(1)(c) GDPR): send only the fields the partner needs. If it needs only the city and the purchase category, do not send names and addresses.

Your side. Article 13(1)(e) GDPR: the information you give people must name the recipients or categories of recipients. If your privacy notice does not mention the partner and the new purpose came later, Article 13(3) requires you to inform people before passing the data on.

The partner's side. Having received data not from the person, the partner must inform them under Article 14 GDPR – within a reasonable period, at the latest within one month. Earlier, whichever comes first: at the first contact with the person, or when it first discloses the data to another recipient (Article 14(3)(a), (b) and (c)). The safest reading is that the one-month limit always applies. The notice must also state where the data came from – you (Article 14(2)(f)).

The GDPR does not require a contract between independent controllers; it is good practice. But Article 24(1) GDPR requires you to be able to demonstrate compliance, so a short data sharing agreement is the best evidence. Our recommendation – ten points:

1. the parties and their roles – both independent controllers;
2. which data is passed on (list of fields);
3. what the partner will use it for;
4. the legal basis each party relies on;
5. how and when data is transferred, over a secure channel;
6. how long the partner keeps it;
7. that the partner will not pass it on without a new basis;
8. who informs people and how;
9. how the parties tell each other about requests and breaches;
10. what happens when a person withdraws consent.

In your record of processing activities, state the category of recipients – Article 30(1)(d) GDPR requires that. Naming the specific partner and where the agreement is kept is worth adding, although it goes beyond the minimum. If the partner is outside the European Economic Area, the transfer rules also apply.

Before the first transfer, go through the five steps and keep your answers. With the tool (in Lithuanian) you can find out free of charge whether you must keep a record of processing activities, which will also show all your data recipients.

May we pass data to a group company?
A group company is a separate legal person, so the same five steps apply. Recital 48 GDPR recognises that a group may have a legitimate interest in transmitting customer or employee data within the group for internal administrative purposes. That does not extend to marketing.

Do we need the person's consent for every transfer?
No, if you have another basis, such as performance of a contract. Consent is needed when there is no other basis, most often when data is passed on for marketing.

May we give a partner customers' emails for marketing?
Only with the people's consent given for exactly that. Email marketing is also subject to separate electronic communications rules.

Who is responsible if the partner misuses the data?
For its own processing – the partner, because it is an independent controller. For a transfer made without a basis – you.

• Are we a controller or a processor? (in Lithuanian)
• We work with a partner – do we need a joint controller arrangement? (in Lithuanian)
• How to carry out a legitimate interest balancing test? (in Lithuanian)
• Consent to process data: how to ask for it and prove it

The law and the risk: GDPR audit, compliance documents and advice – dat.lt

• Legal bases – Article 6(1) GDPR; compatibility criteria – Article 6(4).
• Purpose limitation and data minimisation – Article 5(1)(b) and 5(1)(c) GDPR.
• Recipients in the information to people – Article 13(1)(e) GDPR; a new purpose – Article 13(3).
• The recipient's duty to inform – Article 14(1) and 14(2) GDPR; timing – Article 14(3)(a), (b) and (c); source – Article 14(2)(f); exceptions, e.g. where the person already has the information – Article 14(5).
• Internal administration within a group – recital 48 GDPR.
• Accountability – Article 5(2) GDPR.
• Duty to demonstrate compliance – Article 24(1) GDPR.
• Joint controllers – Article 26(1) GDPR; processor agreement – Article 28(3).
• Recipients in the record – Article 30(1)(d) GDPR.

GDPR read from the official consolidated English text (02016R0679, 04.05.2016). This text is general information and is not individual legal advice.