Disclosure External Data Sharing There are usually three types of external (third party) data sharing: 1. Software providers  his is where you are purchasing or subscribing to a service such as customer relationship T management (CRM) software that is off-the-shelf or possibly tailored for your organisation. In this case, access by the provider to your data will depend on the contract and the nature of the product. Remember: check the contract or terms of service. 2. Services providers or partners  hese can include consultants, contractors and any other organisation with whom you are T collaborating. In this type of data sharing, access by the third party to data held by the NHRI may be very significant. Putting it into practice For service providers or partners, enter into a data sharing agreement. This is a contract that should contain all the obligations you would expect. It doesn’t have to be written by a lawyer – an NHRI can write down the obligations it expects its partners to comply with in a Data Sharing Agreement and ask they formally commit to them. This Agreement should include a commitment to keep certain defined information – e.g. HRD personal information – secure and confidential, only do with it what the Agreement allows, to seek permission before doing anything else with the data, and to inform you if there is a data breach or a suspected data breach. 3. Cloud Storage  his is where you are storing data with an off-premises (“cloud”) storage platform like AWS or T Microsoft Azure. In this case, while there might be the ability to access your data for tech support purposes, this would not be routine access. Data Protection Guidelines for NHRIs Toolkit 14