How data sharing agreements work in GDPRWise: send, negotiate, accept

Every third party you share personal data with needs an agreement that records the roles, the data and the purpose. GDPRWise drafts that agreement from your Third-Party Dossier and sends the other party a link. They read it, then accept, ask for changes or decline. You answer change requests with a new version, until one version is accepted and recorded.

Why a written agreement is needed

When a third party processes personal data on your behalf, Article 28(3) GDPR requires a contract that sets out the subject, duration, nature and purpose of the processing, the type of data, the categories of people involved and the processor’s obligations. Article 28(9) adds that the contract must be in writing, “including in electronic form”. An agreement accepted online therefore counts, as long as you can show who accepted which text and when.

When you share data with another controller, the GDPR does not prescribe a contract in the same way, but you must still be able to show that the sharing is lawful (Article 5(2) and Article 24). A written agreement is the simplest way to do that. The full background is in What is a processing agreement?.

Step 1: send the request

You start on Processes we share with others in your Third-Party Dossier:

1. Add the process, check the data items and pick or type the third party.
2. GDPRWise asks whether you want to preview the request. The preview has two tabs, Email Preview and Agreement Preview: the email the third party receives and the agreement itself.
3. Click Send request. The email goes to the third party’s privacy contact, with a link to review the agreement.

For large providers such as Microsoft or Google, the app shows advice before you send: they rarely sign their customers’ agreements and usually publish their own. You can choose Record their DSA instead to register their published agreement, or Send anyway. The same applies whenever the box Data sharing with this party is already covered by an existing agreement or policy fits: tick it and GDPRWise does not send anything.

After sending, the card shows Pending and Link valid until with a date. The link is valid for 30 days. If the other party has not answered after 23 days, GDPRWise sends them one reminder email with the same link. If it expires before the other party answers, send the request again; it goes out with a new link.

Step 2: what the other party sees

The recipient opens the link and lands on a review page. No account is needed. At the top it says who is asking and what the three choices mean, followed by the status, the link’s expiry date and the current version of the agreement. They can read the agreement on screen or download it as a PDF.

Below the agreement, under Your reply, the recipient has four options:

• Accept the agreement (or Accept version 2, Accept version 3 once there are several versions). They type their full name and role and tick I am authorised to accept this agreement for their company. Acceptance cannot be undone.
• Request changes: a required message describing what should change. There is no file upload; the recipient explains the change in words.
• Decline: a reason, so you know what to improve.
• Send a message: a question or remark without a decision.

If the recipient’s company also uses GDPRWise, the request appears on its Processes others share screen with Open and reply. A logged-in recipient whose request was not linked automatically can use Add this to their company’s dossier on the review page. Whoever answers first, by link or in the app, decides; the other place then shows the outcome.

Step 3: answer a change request with a new version

When the recipient requests changes, your card shows Changes requested and you get an email. Click the document icon on the card to open the agreement. On the left you read the current version; on the right are the history and your actions.

You answer in one of three ways:

• Edit text: you change the wording in the browser, starting from the latest version. Before the editor opens, GDPRWise asks you to confirm with I take responsibility: the standard text is drafted by GDPRWise, but once you change it, the edited wording is your company’s responsibility. You can add a note to the other party and check your changes with Preview changes before you send.
• Regenerate from the dossier, under More actions: GDPRWise builds a fresh version from your current dossier, for example after you corrected the data items.
• Send a message, also under More actions, when a reply in words is enough.

Each new version gets a number and a label: Standard agreement for version 1, Edited by your company, or Regenerated from the dossier. The recipient gets an email and sees the changes against the previous version. Added text is underlined, removed text is struck through. From version 3 on, they can also compare with the standard agreement (version 1).

If you later change the dossier while an edited version is open, GDPRWise never overwrites your edits silently. It asks whether you want to Keep the edited text or Regenerate and send.

Step 4: the outcome

• Accepted: both sides receive a confirmation. The recipient gets the PDF of the accepted version. GDPRWise records the version, the name and role of the person who accepted, the time and a checksum of the document. The accepted file stays exactly as it was reviewed.
• Declined: you see the reason on the card. Adjust the process or the text and send an improved version; the card then reads Declined on a date, improved version sent.
• Withdrawn: under More actions you can Withdraw the request, for example when you stop working with the party. The link stops working, the history stays, and you can reopen the agreement later by sending a new version.
• Expired: the link ran out before an answer. Send the request again.

Accepted agreements are collected on the Data Sharing Agreements tab under GDPR Documents.

Practical tips

1. Check the recipient’s email address before you send. The request goes to their privacy contact; a wrong address means the card shows that the email could not be delivered.
2. Prefer regenerating over editing when the change is about facts in your dossier, such as data items or the data location. Fix the dossier, then regenerate; your register and privacy policy stay consistent with the agreement.
3. Keep edits small and explain them in the note. The recipient sees every change, and a short note avoids another round.
4. Did the other party ask to use their own agreement? Record their agreement instead of sending yours, and keep a copy of it.