Data sharing agreement for a referral partnership

A referral partnership passes a person's details from one business to another so that the second can offer them something, which is a disclosure of personal data by the first and a collection by the second, each a controller needing a basis, with the referred person expecting to be told and the receiving business needing to contact them lawfully. The agreement has to record how the referral is made and on what basis, what the receiving business may do at first contact and after, how commission is tracked without unmentioned data flowing back, and what happens to the referred people when the partnership ends. I draft the data sharing agreement and the privacy notice for the business for a fixed fee of £795, delivered in five working days, with a note on the operational steps the documents assume.

Who this is for

Businesses in England and Wales that refer customers to each other (an accountant and a financial adviser, an estate agent and a mortgage broker, a gym and a physiotherapist) for a fee, a reciprocal arrangement or goodwill.

What matters in a referral partnership's data sharing agreement

The referral as a disclosure and the two controllers it creates

Passing a customer's name and contact details to a partner is a disclosure of personal data by the referring business, which decides to make it and is a controller for it, and a collection by the receiving business, which decides what to do with it and is a controller for its own use, so that Article 28 of the UK GDPR and a processing agreement do not apply and the Information Commissioner's data sharing code of practice is the standard; the agreement should say that each party is a controller, should describe the referral mechanism (a warm introduction, a form the person completes, a list passed across), which decides the basis each party has.

The individual's expectation and the consent or interest that covers the pass

The referring business needs a lawful basis to disclose: the person's consent to the referral (the clearest, obtained at the point of referral: 'may I pass your details to X, who will contact you about Y'), or legitimate interests under Article 6(1)(f) where the referral is something the person would reasonably expect from the relationship and the referring business's privacy notice says it refers customers to partners for the stated purpose; a referral the person did not expect is a disclosure without a basis, and the agreement should require the referring business to obtain the agreement or give the notice the basis needs, and to record it, because the receiving business's position depends on it.

The receiving business's first contact and the rules on marketing

The receiving business must tell the referred person under Article 14 of the UK GDPR, at first contact or within a month, who it is, where it got their details and what it will do with them, and its first contact is marketing if it promotes its services, so that electronic marketing to individuals requires consent under regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 unless the soft opt-in applies (which it does not, because the receiving business obtained the details from a third party rather than in the course of a sale), while a call must be screened against the Telephone Preference Service and a letter may rest on legitimate interests; the agreement should say how the first contact is made (by the referring business introducing, by the person contacting the partner, or by the partner contacting the person with the consent the referring business obtained) so that the contact is lawful.

Commission, tracking and the data that flows back

Where referrals are paid for, the receiving business reports back which referred people became customers, which is a further disclosure of those people's data (that they bought, and perhaps what) to the referring business, needing a basis and a mention in the receiving business's notice, and the agreement should limit the report to what the commission calculation needs (a reference number and a yes or no, rather than the details of the purchase), should say how long the tracking data is kept, and should prohibit the referring business from using the report for anything other than the commission; a referral partnership that shares purchase details both ways has created a data flow neither privacy notice describes.

What each business may and may not do with the referred person

The agreement should state the purpose of the referral and limit the receiving business to it (contacting the person about the stated service, and nothing else, unless the person then agrees to more), should prohibit onward sharing or sale of referred people's details, should say whether the receiving business may add the person to its marketing with the consent the law requires, should require each party to keep the data secure under Article 32 and to tell the other of a breach affecting referred people in time for each party's seventy-two-hour deadline under Article 33, and should require each party's privacy notice to describe the partnership; the referred person who objects to either party is honoured by both, and the agreement should say how objections are passed on.

The end of the partnership and the referrals already made

When the partnership ends the receiving business keeps the referred people who became its customers (as its own controller, on its own basis) and should delete the details of those who did not, the referring business stops referring and deletes the tracking data once commission is settled, each party's notice is updated, and the agreement's confidentiality and the limits on use survive; the agreement should also address a referral partner who turns out to be sending unsolicited marketing to the referred people or sharing them onward, with termination and the right to require deletion; the note that comes with the documents lists the consent wording and the notice updates each party needs.

What it costs

DPA and privacy terms, £795. Data processing agreement plus privacy notice. Five working days.

Review of a customer's DPA, £495. They sent theirs and you need to know what you are accepting. Returned marked up with the changes to ask for and an explanation. Three working days.

Buying online forms the engagement on payment. The scope is what the data protection agreements and privacy terms page describes, you accept the Terms of Service at checkout, and I email you within four working hours to get started. If you would rather ask something first, email me.

What you get

• A data processing agreement that meets the statutory requirements and can be used as a schedule to your main contract
• A privacy notice written for people to read rather than to be scrolled past
• Clear allocation of controller and processor roles, which is where most confusion starts
• International transfer provisions where you use overseas suppliers
• Sub-processor and security provisions proportionate to what you do
• A note on the operational steps the documents assume you are taking

What is not included

• Full compliance audits and data mapping exercises
• ICO registration, which you do yourself
• Breach response and regulatory correspondence
• Cyber security certification such as Cyber Essentials
• Advice on data protection law outside the UK and EU

Questions I am often asked

We pass customers to a partner and they pay us commission. Do we need an agreement?

An agreement is needed: the referral is a disclosure needing a basis, the partner's first contact must be lawful, and the commission report is a further flow of data. The agreement records each and both privacy notices describe the partnership.

Can our partner email the people we refer?

Only with the person's consent to that contact, which the referring business should obtain at the point of referral, because the soft opt-in does not apply to details obtained from a third party. A warm introduction or a call screened against the preference service are the alternatives the agreement provides for.

What happens to referred customers when the partnership ends?

The partner keeps those who became its customers, deletes the rest, and both parties stop the flow and update their notices. The agreement says so.

Related guidance and services

• Data protection agreements and privacy terms, £795, the service this page describes
• SaaS and technology contracts, £995
• Terms and conditions drafting, £995
• Data sharing agreement between two controllers
• Reviewing a referral or introducer agreement

This page is general guidance for businesses in England and Wales, not advice on your own circumstances. Last reviewed: October 2026. Email geoffrey@caesar.co.uk.