WASPI UK GDPR Code of Conduct for Information Sharing Protocols published

New UK GDPR Code of Conduct by WASPI gives organisations a clearer, more consistent framework for sharing personal information safely, lawfully and confidently.

Strengthening Safe and Lawful Information Sharing Across Wales

The Wales Accord on the Sharing of Personal Information (WASPI) is proud to launch the WASPI UK General Data Protection Regulation (GDPR) Code of Conduct for Information Sharing Protocols (ISP), providing organisations with a robust framework to support lawful, transparent and accountable information sharing across Wales.

The Code has been developed under Article 40 of the UK GDPR and is designed to help organisations apply data protection requirements consistently when sharing personal information for the delivery of health, education, social care, safeguarding and other public services. It introduces enhanced assurance measures through the mandatory use of the WASPI (ISP) template, ongoing monitoring, governance requirements and regular review mechanisms.

With over 1,000 organisations already signed up to the WASPI Accord, the new Code represents the next stage in strengthening confidence in information sharing arrangements while protecting the rights and freedoms of individuals.

Supporting Better Outcomes Through Responsible Information Sharing

Effective information sharing is essential for delivering integrated services and protecting vulnerable individuals. Failure to share relevant information appropriately can create significant risks, particularly in safeguarding situations where timely access to information can be critical. The WASPI Code seeks to address these challenges by providing organisations with a clear, recognised and consistent approach to reciprocal information sharing and ensuring that data sharing activities are regularly reviewed.

Strengthening Accountability

The UK GDPR Code of Conduct introduces six key requirements covering governance, use of approved templates, quality assurance, accountability, reviews of information sharing arrangements and compliance with ongoing monitoring, providing participating organisations with a recognised framework to demonstrate compliance with key UK GDPR principles, including lawfulness, transparency, accountability, security and data minimisation.

Dave Parsons, WASPI Code Manager, said:

"The WASPI UK GDPR Code of Conduct for Information Sharing Protocols represents a significant step forward in supporting organisations to share information confidently, consistently and lawfully. By providing clear standards, robust governance arrangements and independent monitoring, the Code helps organisations meet their information-sharing responsibilities while maintaining the trust of the people they serve. Ultimately, the Code will support better outcomes for individuals through more effective collaboration between organisations and regular reviews of data sharing practices between organisations.

"I would like to take the opportunity to thank colleagues from the Information Commissioner's Office (ICO) Code Team and ICO Wales Team for their extensive support in developing this approved UK GDPR Code of Conduct, the first Code of Conduct across the UK to cover public and third sector partners.

"We look forward to working alongside the ICO to ensure that the WASPI service is established as an independent Monitoring Body and to supporting partners applying for Code membership during the coming months."

Chris Hogan, Head of Regulatory Strategy at the ICO, said:

"We are pleased to support the WASPI Code of Conduct which will help ensure responsible, lawful and accountable data sharing across Welsh public services. Approved under Article 40 of the UK GDPR, it builds on existing good practice within the established WASPI framework, giving organisations a clear and recognised way to demonstrate accountability, transparency and responsible data use. This kind of consistent approach is what helps promote and maintain public trust, particularly in areas like safeguarding, health and social care, where effective information sharing can be critical. We look forward to continuing to work with WASPI as they take this forward."

Further information

For further information about the WASPI UK GDPR Code of Conduct, please visit our webpages: https://www.waspi.gov.wales