Data Sharing
Making personal data available to another organisation.
Data sharing means giving personal data to another organisation, whether by sending a file, opening a system or letting it collect directly. It is a kind of processing and must be justified like any other.
Meaning of Data Sharing
Sharing is a form of processing. It needs a lawful ground, a notice that tells the person about it, and in many cases consent. The Right to Access in the Act lets people ask which other fiduciaries and processors received their data.
The Act lists sharing and disclosure by transmission or dissemination among the operations that make up processing in Section 2. So every handover of personal data, to a vendor, a partner, a group company or a regulator, is processing that needs a purpose and a lawful ground. The method does not matter. An API feed, a monthly CSV upload, a shared dashboard and a spreadsheet emailed to an agency are all sharing.
The kind of recipient changes the analysis. Sharing with a Data Processor is allowed under Section 8(2) only under a valid contract, and the fiduciary keeps responsibility under Section 8(1) and for security under Section 8(5). Sharing with another Data Fiduciary needs a ground of its own, typically specific consent or a Section 7 use such as a legal disclosure to the State. Section 8(3) adds that when data is likely to be disclosed to another fiduciary, it should be complete, accurate and consistent.
Two other layers matter. Section 11 gives the Data Principal a right to know the identities of the other fiduciaries and processors with whom her data was shared and a description of what was shared, with an exception for law-enforcement requests described in Section 11(2). Cross-border sharing is governed by Section 16 and Rule 15: transfers are allowed except to countries the Central Government restricts, and any stricter sectoral law, such as an RBI localisation direction, continues to apply.
Sharing is not the same as selling, and it is not the same as publishing. The Act does not create a separate regime for sale of data, so any exchange for value is judged by the same consent and purpose rules. Pooling data into a joint venture, giving access to an auditor, and exposing records on a public web page are different forms, but each needs its own check. The bar is highest where the shared data concerns children, where Section 9 bars tracking and targeted advertising.
Examples of Data Sharing
A travel app sends a traveller's details to an airline to issue a ticket. That sharing is part of the booking and should be disclosed in the notice.
A booking app sends a traveller's name and passport details to an airline to issue a ticket. The notice discloses this as part of the booking, and only fields the airline needs are transmitted.
A school shares student attendance data with a transport vendor for bus routing. It signs a processing contract, limits the data to names and pick-up points, and does not allow the vendor to use it for advertising.
A start-up wants to give its customer list to an affiliate marketer. It realises that this is sharing with an independent recipient, so it seeks specific consent through a separate checkbox and keeps a log of who agreed.
Why Data Sharing matters
A large share of data incidents begins at a hand-off: a vendor with weak controls, a misdirected file, an over-wide API. Because the fiduciary remains accountable, the cost of a recipient's failure comes back to it, including potential penalties of up to ₹250 crore for lapses in security safeguards and up to ₹200 crore for failing to report a resulting breach.
Sharing is also where consent is most often exceeded. People generally accept use of their data to deliver a service but object when it appears in someone else's marketing. A clear sharing practice supports trust and reduces complaints under Section 13.
How it works in practice
- 1Map all data flows leaving your organisation, with the fields, recipient, purpose, method, frequency and location of the recipient. Keep the map current as systems change.
- 2Choose the ground for each flow: processor instruction under contract, specific consent for independent recipients, or a Section 7 use where it truly applies. Record the decision.
- 3Use written agreements. For processors, set purpose limits, security controls in line with Rule 6, breach notice, sub-processor approval, audit rights and deletion on exit. For independent recipients, set out each party's duties.
- 4Reduce what you send. Share only the necessary fields, mask identifiers, and use secure transfer, with access logs and expiry on shared links.
- 5For cross-border flows, check the Central Government's restrictions and your sector rules before transfer, and mention the sharing in your notice.
- 6Be ready for Section 11 requests by keeping a disclosure log that can produce the list of recipients for any individual.
Where it appears in the DPDP Act and Rules
Common mistakes to avoid
Assuming internal sharing between group entities is not sharing. Each company is a separate person.
Sending full datasets when a few fields would do. Excess sharing raises both consent and security risk.
Relying on a vendor's standard terms. These often allow the vendor to reuse data, which changes its role.
Not tracking shared-link or API access after a project ends. Old access routes keep data exposed.
Compliance tips
Keep a single register of recipients that doubles as your answer to access requests.
Review all active API keys, shared drives and SFTP accounts each quarter and close those that are not in use.
Use pseudonymised or aggregated data when the recipient does not need to identify individuals.
Give business teams a short approval form for any new data-sharing arrangement, signed by legal and security.
Common questions about Data Sharing
Is data sharing allowed under the DPDP Act?
Yes, when it has a lawful ground and a stated purpose. Sharing with processors needs a valid contract under Section 8(2), and sharing with independent fiduciaries usually needs specific consent unless a Section 7 [legitimate use](term/legitimate-uses) applies.
Do I need consent to share data with a vendor?
Not separately if the vendor is your Data Processor and works only on your instructions for the purpose already notified, though you must have a contract and apply safeguards. If the vendor uses the data for its own aims, treat it as an independent recipient.
Can I share personal data outside India?
Section 16 allows transfer except to countries the Central Government restricts by notification, and Rule 15 may impose conditions. Stricter sectoral laws, for example RBI or SEBI requirements, prevail where they apply. Check these before any overseas hosting or support arrangement.
Is sharing data the same as selling it?
No. Selling is one form of sharing, usually for payment. The Act applies the same tests to both: purpose, lawful ground, notice and security. Payment does not create a separate legal category, but it makes unconsented disclosure harder to defend.