This is a statutory code of practice made under section 121 of the Data Protection Act 2018. It is a practical guide for organisations about how to share personal data in compliance with data protection legislation.

It explains the law and provides good practice recommendations.
​Following it along with other ICO guidance will help you to:
* manage risks;
* meet high standards;
* clarify any misconceptions your organisation may have about data sharing; and
​* give you confidence to share data appropriately and correctly. 
​
Introduction to the Code (my bold and bullet points)

Cover of the Consultation Document of a Data sharing code of practice - published by ICO 15 July 2019

What happens if we don’t comply with the code?

If you don’t comply with the guidance in this code, you may find it more difficult to demonstrate that your data sharing is fair, lawful and accountable and complies with the GDPR or the DPA.

If you process personal data in breach of this code and this results in a breach of the GDPR or the DPA, we can take action against you.

Tools at our disposal include assessment notices, warnings, reprimands, enforcement notices and penalty notices (administrative fines). For serious breaches of the data protection principles, we have the power to issue fines of up to €20 million or 4% of your annual worldwide turnover, whichever is higher.

There is no penalty if you fail to adopt good practice recommendations, as long as you find another way to comply with the law.

About this code (page 7) My red highlighting re, penalties which can be imposed

The transfer of databases or lists of individuals is a form of data sharing. This may include sharing by data brokers, marketing agencies, credit reference agencies, clubs and societies, and political parties. You are responsible for compliance with the law for the data you receive, and for data that is shared on your behalf. You must make appropriate enquiries and checks in respect of the data, including its source and any consent given. 

​Introduction to the Code

Use our checklist to improve your understanding of data protection and find out what you need to do to make sure you are keeping people’s personal data secure. Once you have completed the checklist a short report will be created suggesting some practical actions you can take and providing links to additional guidance you could read that will help you improve your data protection knowledge and compliance.

More information on this website

What has PayPal done about GDPR?
​

Whose responsibility is it to keep this data safe?
​

How should she tell customers about whether or not PayPal are compliant (if she doesn't know!)
​

Who is responsible re. data protection if somebody hacks into her Paypal account?
​