“Data protection” does not mean data can never be shared. It means each disclosure needs a purpose, lawful basis, fairness, necessity, transparency, security and accountability.
Key points
- Identify the sender and recipient and whether each is a controller or processor.
- Ask what exact data was shared, when, why and under which basis.
- A data-sharing agreement is useful evidence, but it does not make an unnecessary disclosure lawful.
- A controller should take reasonable steps to correct recipients after certain rectification, erasure or restriction outcomes.
- SAR information can reveal recipients or categories of recipients, subject to the applicable law.
Routine and one-off sharing
Routine sharing should be designed and documented. One-off disclosure still requires a defensible purpose and basis. Emergency or safeguarding contexts may justify sharing without consent, but the decision should still be necessary, proportionate and recorded.
Controller-to-controller or processor
A processor handles data on documented instructions and has contractual safeguards. A separate controller determines its own purpose. This classification affects who answers rights requests, who decides retention and which organisation must remedy an inaccurate disclosure.
Ask about actual recipients
“Third parties” is often too vague to resolve a dispute. Identify the event, approximate date and category. A SAR can ask for the Article 15 recipient information and personal data showing the disclosure. A complaint can then test purpose, basis and necessity.
Correction downstream
If inaccurate data has spread, correcting only the source system may leave harm in place. Ask what recipients received the data and whether the controller will notify them of rectification, erasure or restriction where the law requires.
Build the record
Turn the concern into answerable questions
- Identify the exact personal data or processing activity.
- Record dates, systems, people and any decision or disclosure affected.
- Choose the right legal tool for the outcome you need.
- Ask for a reasoned answer and a specific corrective action.
- Keep the request, acknowledgement, evidence and final response together.
If several rights are involved, number them separately. A request for access, a request to correct data and a complaint about previous handling can run alongside one another, but they have different legal tests and may have different deadlines.
Worked examples
| What happened | The data-protection question | Likely next route |
|---|---|---|
| Insurer sends a claim flag to a database | Identify the field, purpose, basis, recipient and correction route. | Access, accuracy and rectification |
| School shares safeguarding information | Test necessity and safeguards without assuming consent was required. | Lawful basis and complaints |
| Supplier hosts customer records | The supplier may be a processor, but the retailer remains responsible for the rights response. | SAR and complaint |
Useful wording
“Please identify the personal data disclosed, date, recipient, purpose, lawful basis and necessity for the disclosure. If the information was inaccurate or excessive, please restrict further use and notify relevant recipients of the correction.”
Keep the request focused on the data or processing activity. Ask the organisation to identify its position and the corrective action it will take. Keep a copy and proof of delivery.
Official sources
Check the rules behind this guide
These are official or primary sources. Check the current text before relying on a formal deadline, procedure or court route.