Data Sharing Agreement Between Fiduciaries Template

DATA SHARING AGREEMENT BETWEEN DATA FIDUCIARIES

This Data Sharing Agreement ("Agreement") is entered into on [Date] between:

[Organization Name A], having its registered office at [Address] ("Party A"),
AND
[Organization Name B], having its registered office at [Address] ("Party B"),
each acting as an independent Data Fiduciary under the DPDP Act, 2023, and collectively "the Parties".

RECITALS
The Parties wish to share personal data with each other in connection with [describe joint activity, e.g., "a co-branded loyalty programme", "a referral partnership", "joint underwriting of insurance products"], with each Party determining its own purpose and means of processing the shared data as an independent Data Fiduciary, rather than one Party processing solely on the other's instructions.

1. ROLES OF THE PARTIES
Both Party A and Party B act as independent Data Fiduciaries in respect of the personal data shared under this Agreement. Neither Party acts as a "Processor" for the other. Each Party is separately responsible for its own compliance with the DPDP Act, 2023 in respect of the data it processes.

2. DESCRIPTION OF DATA SHARED
   a. Data shared by Party A with Party B: [describe categories, e.g., name, contact details, transaction history relevant to the joint programme]
   b. Data shared by Party B with Party A: [describe categories, if bidirectional]
   c. Purpose of sharing: [state specific purpose(s)]
Full detail is set out in Annexure A.

3. LEGAL BASIS FOR SHARING
Each Party confirms that it has obtained valid consent from the relevant Data Principals for the sharing described in this Agreement (per Sections 5 and 6 of the DPDP Act), or that the sharing falls within a legitimate use recognised under Section 7, and each Party shall provide the other, on request, with evidence of the applicable legal basis.

4. NOTICE OBLIGATIONS
Each Party is independently responsible for providing its Data Principals with itemised notice under Section 5, including disclosure that data will be shared with the other Party and the purpose of such sharing, before or at the time of collecting consent.

5. SECURITY SAFEGUARDS
Each Party shall implement reasonable security safeguards for the data it receives, consistent with Section 8(5) of the DPDP Act and the baseline standards under the DPDP Rules, 2025 (encryption, access control, activity logging), and shall not process the shared data in a manner inconsistent with the purpose stated in Annexure A.

6. RESTRICTIONS ON FURTHER SHARING
Neither Party shall further share the data received under this Agreement with any third party, other than its own processors bound by a Data Processing Agreement for purposes consistent with Annexure A, without the prior written consent of the originating Party.

7. DATA PRINCIPAL RIGHTS
Where a Data Principal exercises a right of access, correction, or erasure (Sections 11-12) with one Party in relation to data that was shared under this Agreement, that Party shall promptly notify the other Party, and both Parties shall cooperate to give effect to the request within their respective systems.

8. BREACH NOTIFICATION BETWEEN PARTIES
If either Party experiences a Personal Data Breach affecting data shared under this Agreement, it shall notify the other Party without undue delay, and in any event within [X hours], to enable both Parties to meet their respective intimation obligations to the Data Protection Board of India and affected Data Principals under Section 8(6).

9. RETENTION AND ERASURE
Each Party shall retain the shared data only for as long as necessary for the purpose stated in Annexure A, or as required by law, and shall erase or return the data upon the earlier of completion of that purpose or termination of this Agreement.

10. INDEPENDENT LIABILITY
Each Party shall be independently liable for its own non-compliance with the DPDP Act, 2023 in respect of the data it processes, and this Agreement does not create joint and several liability between the Parties except to the extent expressly agreed in writing.

11. TERM AND TERMINATION
This Agreement remains in effect for [duration] or the term of the underlying joint activity described in the Recitals, and may be terminated by either Party on [X days'] written notice, subject to survival of data-retention and erasure obligations.

12. GOVERNING LAW
This Agreement is governed by the laws of India, with courts at [City] having exclusive jurisdiction.

For [Organization Name A]                        For [Organization Name B]
Name: ______________________                    Name: ______________________
Title: ______________________                   Title: ______________________

ANNEXURE A: Description of Shared Data, Purpose, Direction of Flow, and Retention Period