Sharing personal data with third parties: the 7 GDPR risks to manage

You may only share personal data under the GDPR if you have a legal basis under Article 6, have settled in writing whether the recipient is a processor or a controller, and have told the people concerned about the sharing. The main exceptions are transfers outside the European Economic Area (EEA) and high-risk processing, which bring extra requirements under Chapter V and Article 35 GDPR.

In the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) enforces the GDPR together with the Dutch implementing act (Uitvoeringswet AVG, UAVG). Every flow to a cloud provider, payroll bureau, debt collector or group company abroad is a separate processing operation that needs its own justification. Below we set out seven risks that recur in practice, the provisions behind them and what you can do about each.

Risk 1: are you sharing data without a valid legal basis?

Every disclosure of personal data needs one of the six legal bases in Article 6(1) GDPR. A commercial reason is not one of them.

The six bases are exhaustive: consent, performance of a contract, a legal obligation, vital interests, a public task and legitimate interests. Article 5(1)(a) adds that processing must be lawful, fair and transparent, so a basis that was never explained to anyone still leaves a gap.

Why is legitimate interest a trap?

Legitimate interests is the basis most often used for sharing with partners, and most often used incorrectly. It requires a three-step test:

• the interest must be legitimate;
• the sharing must be necessary to serve it;
• the interest must not be overridden by the rights and freedoms of the people concerned.

You must carry out and record this test before the sharing starts, because Article 5(2) GDPR puts the burden of proof on the controller (accountability). An assessment written after a complaint arrives is worth very little.

What about consent and purpose limitation?

Consent from employees is rarely valid, because the imbalance of power means it is not freely given (Article 7(4) and recital 43 GDPR). Purpose limitation under Article 5(1)(b) also applies to sharing: data collected to deliver a service cannot simply go to a partner for marketing. Where the new purpose is not compatible with the original one, you need a fresh basis.

What to do: identify the basis before data leaves your organisation, write it down and check that your privacy notice already describes the sharing. Consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give (Articles 4(11) and 7(3) GDPR).

Risk 2: have you got the controller and processor roles wrong?

A controller decides the purposes and means of processing; a processor only acts on the controller’s documented instructions (Article 4(7) and (8) GDPR). What counts is who actually decides, not what the contract calls the parties.

The common error is to label every supplier a processor. Yet none of the following acts purely on instructions:

• a SaaS provider that uses customer data to improve its own product;
• an accountant bound by professional rules;
• a bank executing a payment;
• an advertising platform that builds its own audience profiles.

Each is a controller for at least part of the processing. Where two organisations jointly determine purposes and means, they are joint controllers under Article 26 GDPR. They must set out their responsibilities in an arrangement and make its essence available to the people concerned.

How broadly does the EU Court of Justice define joint control?

Broadly. In Fashion ID (C-40/17), the Court of Justice held that a website operator embedding a third-party social plug-in was a joint controller for the collection and transmission of visitors’ data, even though it had no access to the data afterwards. Partial influence over the purposes is enough, and the result is joint liability for a breach you did not cause.

What to do: map the data flows and record, for each flow, who decides why and how the data is processed. Use a processing agreement under Article 28 for processors and a joint controller arrangement under Article 26 where both parties decide.

Risk 3: is your data processing agreement missing or defective?

If a processor handles personal data for you, Article 28(3) GDPR requires a written contract. Without it, you are in breach from the moment processing begins, even if no data ever leaks.

The content is prescribed by law. A compliant data processing agreement states the subject matter, duration, nature and purpose of the processing, the types of personal data and categories of people, and the controller’s rights and obligations. It must also bind the processor to:

• process only on documented instructions;
• impose confidentiality on its staff;
• take the security measures required by Article 32;
• help with data subject requests and breach notification;
• delete or return the data at the end of the engagement;
• provide the information needed to demonstrate compliance, and allow audits.

Why do sub-processor clauses so often fail?

Under Article 28(2) and (4), the processor needs your prior specific or general written authorisation for any sub-processor. With a general authorisation, it must inform you of intended changes and give you the chance to object; a clause letting it engage anyone it likes does not meet that standard.

What to do: work from a template that follows Article 28(3) clause by clause and review existing agreements rather than relying on a supplier’s own terms. Long-standing relationships are the most likely to be undocumented.

Risk 4: are you transferring data outside the EEA without safeguards?

A transfer outside the EEA is only allowed on the basis of an adequacy decision (Article 45 GDPR) or appropriate safeguards (Article 46), usually the Commission’s standard contractual clauses (SCCs) or binding corporate rules. The derogations in Article 49, such as explicit consent, are for occasional transfers and cannot support a structural data flow.

A transfer takes place whenever data becomes accessible from outside the EEA, not only when it is copied there. Remote administration by a parent company abroad is a transfer, even if the servers stay in Frankfurt.

What do Schrems II and the Data Privacy Framework mean for you?

In Schrems II (C-311/18), the Court of Justice invalidated the EU-US Privacy Shield and held that standard contractual clauses are not enough on their own. The exporter must assess whether the law of the destination country undermines the clauses and add supplementary measures where it does; that transfer impact assessment (TIA) is still required for every Article 46 transfer.

The Commission adopted an adequacy decision for the EU-US Data Privacy Framework (DPF) in July 2023, and on 3 September 2025 the General Court dismissed an action for its annulment (Latombe, T-553/23). Transfers to a US organisation certified under the framework, for the data its certification covers, can rely on adequacy; transfers to other US recipients cannot. An appeal to the Court of Justice is possible, so check the certification and keep a fallback in place.

What to do: list the third-country transfers in your supply chain, including sub-processors and support arrangements. Where adequacy does not apply, use the current SCCs, document a TIA and record supplementary measures such as encryption with keys held in the EEA. The AP can order a transfer to be suspended under Article 58(2)(j) GDPR.

Risk 5: are you skipping a data protection impact assessment?

Article 35 GDPR requires a data protection impact assessment (DPIA) where processing is likely to result in a high risk to individuals. Sharing data often crosses that threshold sooner than organisations expect.

Article 35(3) names three cases: systematic and extensive automated evaluation with legal or similarly significant effects, large-scale processing of special categories or criminal data, and large-scale systematic monitoring of a public area. The AP also publishes a list of operations for which a DPIA is always required. Combining datasets, sharing health data with an analytics provider or monitoring employees will often cross the threshold on its own.

What must a DPIA contain?

Under Article 35(7), a DPIA describes the processing and its purposes, assesses necessity and proportionality, identifies the risks to the people concerned and sets out the measures that address them. Where a high residual risk remains, Article 36 requires prior consultation of the AP before the processing starts.

What to do: screen every new data-sharing arrangement against Article 35(3) and the AP list, and involve your data protection officer if you have one. Revisit the DPIA when the processing changes; failing to carry out a required DPIA is an infringement in itself.

Risk 6: are you telling people too little about the sharing?

Transparency is a separate obligation, which you can breach even where the sharing itself is lawful. Articles 13 and 14 GDPR require you to state the purposes, the legal basis and the recipients or categories of recipients.

A sentence saying that data “may be shared with trusted partners” identifies nothing. Name the categories concretely, such as hosting providers, payroll administrators or credit reference agencies. For transfers outside the EEA, Articles 13(1)(f) and 14(1)(f) require the notice to say so and to identify the safeguard relied on.

What extra applies when you did not collect the data yourself?

Under Article 14, the notice must also state the categories of data and their source. You must provide it within a reasonable period and at the latest within one month, or at the first communication with the person if that comes sooner. Our page on a privacy policy in the Netherlands sets out the full content.

What to do: update the notice before a new recipient receives data, not at the next annual review. Article 12(1) requires notices to be concise, intelligible and in clear and plain language.

Risk 7: are you treating pseudonymised data as anonymous?

For the organisation that holds the key, pseudonymised data remains personal data. Only true anonymisation takes data outside the GDPR.

Article 4(5) GDPR defines pseudonymisation as processing data so that it can no longer be linked to a person without additional information that is kept separately. Recital 26 confirms that such data stays within the GDPR for whoever can re-identify it. Replacing names with customer numbers therefore does not remove the need for a legal basis, a processing agreement or a privacy notice on your side.

Can pseudonymised data be non-personal for the recipient?

Possibly. In EDPS v SRB (C-413/23 P, 4 September 2025), the Court of Justice held that pseudonymised data need not be personal data for a recipient who cannot reasonably re-identify the people concerned. The court also held that the disclosing controller must still inform those people about the recipient at the time of collection.

What to do: assess the means reasonably likely to be used by the recipient, including other datasets it holds; a postcode, date of birth and transaction history often allow re-identification. Document how the key is kept separate. Article 32 names pseudonymisation as a security measure, which counts in your favour if a breach is assessed.

What does enforcement look like in the Netherlands?

Under Article 58 GDPR, the AP can warn, reprimand, order compliance, ban processing and suspend transfers, and Article 83 allows fines. For a business that depends on a particular data flow, a ban is often more damaging than the fine.

Article 83 has two tiers, each with a fixed maximum or a percentage of worldwide annual turnover in the previous financial year, whichever is higher:

• Lower tier: up to EUR 10 million or 2%, for example for a missing processing agreement or DPIA (Articles 25 to 39).
• Higher tier: up to EUR 20 million or 4%, for breaches of the principles, the legal bases, data subject rights and the transfer rules.

Article 82 GDPR gives anyone who suffers material or non-material damage a right to compensation from the controller or processor. In the Netherlands, foundations increasingly bring such claims collectively under the Act on the settlement of mass damages in collective actions (Wet afwikkeling massaschade in collectieve actie, WAMCA, Article 3:305a BW).

If unlawful sharing leads to a data breach, Article 33 requires notification to the AP without undue delay and, where feasible, within 72 hours, unless the breach is unlikely to result in a risk. Under Article 34 you must also inform the people affected if the risk to them is high. Document every breach internally, including those you do not notify.

What should you check as the organisation sharing the data?

As controller, you carry the main responsibility and must be able to prove compliance under Article 5(2) GDPR. Check these points before data leaves your organisation:

• The legal basis under Article 6 is identified and, for legitimate interests, the balancing test is on file.
• The recipient’s role is recorded in your record of processing activities under Article 30.
• A processing agreement under Article 28 or an arrangement under Article 26 is signed.
• Any transfer outside the EEA rests on adequacy or SCCs plus a TIA.
• A DPIA screening has been done and documented.
• Your privacy notice names the recipient or its category.

What should you check as the recipient of the data?

As a processor or receiving controller, you have your own obligations and can be fined directly under Article 83 GDPR. Check these points before you accept the data:

• Whether you act only on instructions (processor) or also use the data for your own purposes (controller).
• Whether the instructions in the processing agreement match what you actually do with the data.
• Whether your sub-processors are authorised in writing under Article 28(2).
• Whether your security measures meet Article 32 and you can notify breaches to the controller without undue delay (Article 33(2)).
• Whether you keep your own record of processing under Article 30(2).

What can we do for you with GDPR data sharing?

Our IT law team handles the data protection side of supplier, group and partner arrangements. Concretely:

• We map your data flows and determine for each recipient whether it is a processor, joint controller or independent controller.
• We draft or review processing agreements under Article 28 and joint controller arrangements under Article 26.
• We assess transfers outside the EEA, check DPF certifications and draft the transfer impact assessment.
• We carry out or review the DPIA screening and the DPIA itself.
• We update your privacy notice so that recipients and transfers are named correctly.
• We assist you in an AP investigation or with a breach notification within the 72-hour deadline.

Summary

• Every sharing of personal data needs a legal basis under Article 6 GDPR; a commercial reason is not enough.
• Determine for each recipient whether it is a processor, a joint controller or an independent controller, and document it.
• A processing agreement under Article 28 is mandatory for processors; without one you are in breach from day one.
• Transfers outside the EEA need adequacy (such as a DPF certification) or safeguards plus a transfer impact assessment.
• Pseudonymised data stays personal data for whoever holds the key, and your privacy notice must name the recipients concretely.

Frequently asked questions