◇ OpenCyber Academy
Bachelor's · Chapter 24 · English

Chapter 24 — Data sharing agreements

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 24 — Data sharing agreements

Lesson map

Lesson 24 published. Map, example, EX070.

flowchart TD
  N0["Learning outcomes"]
  N1["24.1 When sharing happens"]
  N2["24.2 Key terms"]
  N3["24.3 Aggregated sharing"]
  N4["24.4 Monitoring"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX070"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["24.1 When sharing happens"]
  N2["24.2 Key terms"]
  N3["24.3 Aggregated sharing"]
  N4["24.4 Monitoring"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX070"]

[Learning outcomes]
    |
    v
[24.1 When sharing happens]
    |
    v
[24.2 Key terms]
    |
    v
[24.3 Aggregated sharing]
    |
    v
[24.4 Monitoring]
    |
    v
[Worked example] --> [Exercise EX070]

Learning outcomes

You will (1) identify when data sharing needs an agreement; (2) draft key terms; (3) monitor sharing over time.

24.1 When sharing happens

Harbourline shares data with suppliers, a payment processor, a delivery company and the co-operative federation that compiles sector statistics. Amara lists each flow with data shared, purpose and existing contract terms. Some flows have detailed contracts; others rely on informal arrangements made years ago. She notes that every flow carries risks, such as the receiving party using data for other purposes, and that agreements make expectations explicit and enforceable. Amara records which flows lack any written agreement, and finds three such flows among the eleven she lists.

24.2 Key terms

Amara drafts a template agreement with terms for purpose, data fields, security, onward sharing, retention and deletion, breach notification, audit rights and ending the agreement. For personal data, she includes processor terms required by the GDPR where the receiver acts on Harbourline's behalf. She asks the legal adviser to review the template. She explains that a template saves time and ensures that important terms are not forgotten when new sharing begins. The legal adviser suggests two changes, which Amara makes before the template is adopted.

24.3 Aggregated sharing

The federation asks for store-level sales by product category. Amara checks whether any category in small stores could reveal individual purchases, such as a specialist product bought by very few customers. She suggests suppressing cells with fewer than ten transactions. The federation agrees. She notes that sharing aggregates is often safer than sharing records, but small numbers can still reveal individuals, which NIST SP 800-188 discusses when describing disclosure risks. Amara writes the suppression rule into the federation agreement so that it applies to every future submission as well.

24.4 Monitoring

Agreements must be monitored. Amara proposes a register of sharing agreements with owners, review dates and checks, such as confirming each year that the delivery company deleted data from ended contracts. She finds one supplier still receiving a weekly file five months after the contract ended, because nobody had switched off the export. Dr. Lindqvist notes that ending sharing is as important as starting it, and is often forgotten. The export is switched off the same day, and the supplier confirms in writing that the received files were deleted.

Worked example

Amara lists sharing flows, drafts an agreement template, suppresses small cells in federation statistics and finds an export still running after a contract ended.

Synthetic case. Flows are synthetic; the GDPR and NIST SP 800-188 are real.

Errors and limits

Informal sharing arrangements drift beyond their original purpose.

Exercises

Continue studying — lesson 24 (chapter 24 of 40)

← Chapter 23 · Course chapter index · Chapter 25 →

Continue to the next authored lesson.