The Custody Question: Board Oversight of Shared Data in Partnering Arrangements

Shared data is rarely the reason a partnership is formed, but it is often the reason a partnership becomes difficult to unwind. Customer records, operational metrics, performance dashboards and case notes move between organisations long before a board asks who owns them, who can see them, and what happens when the relationship changes. For UK organisations, the question is not simply legal compliance. It is custodianship: whether the board can demonstrate that information entrusted to the partnership is handled with the same care as information held within the institution itself.

Boards do not need to draft data-sharing schedules. They do need to set the rules that make those schedules meaningful. The following framework is intended to help boards govern shared information as strategic infrastructure rather than as an operational afterthought.

Why the board cannot delegate custody

It is tempting to leave data flows to delivery teams, particularly when a partnership is progressing well. Delivery teams understand the practicalities: which systems connect, which reports are exchanged, which colleagues need access. But delivery teams also face pressure to keep the relationship moving. They may accept informal arrangements, tolerate ambiguous access rights or postpone exit planning because raising difficult questions feels counter-relational.

The board's role is to hold the longer view. It should ask whether the partnership's information architecture is consistent with the organisation's legal obligations, risk appetite and public commitments. Under the UK GDPR and the Data Protection Act 2018, controllers must be able to demonstrate accountability. In a partnership, that accountability does not disappear because another organisation holds the data or because a joint delivery model blurs the lines. The board should be satisfied that roles are clear, lawful bases are recorded, and responsibilities are not left to goodwill.

Start with an information map

A board-level conversation should begin with a simple inventory. What information does the partnership actually rely on? This includes obvious categories such as customer or service-user data, but also operational data, financial reconciliations, staff performance information, incident logs and management information used to steer the relationship.

For each category, the board should establish a small set of facts: its purpose, its source, its sensitivity, who holds it, who can access it, and how long it is retained. Special category data, criminal offence data and information about vulnerable service users warrant particular attention. So does commercially sensitive information, which may not be personal data but can still create partnership risk if it is shared too freely or retained too long.

The output need not be a lengthy register. It should be a shared reference point that allows the board to see where information concentration exists. If one partner holds most of the data, or if data flows are poorly documented, that is a governance signal.

Agree the legal architecture before the flow

Data-sharing agreements are often treated as paperwork to be completed after the operating model is designed. In practice, the legal architecture shapes the operating model. The board should seek assurance that the partners have agreed whether they are acting as controllers, processors or joint controllers for each material data flow. That determination affects responsibilities for subject access requests, breach notification, retention and lawful basis.

A data protection impact assessment may be appropriate where processing is large-scale, involves sensitive information or introduces new technology. The board does not need to review every assessment, but it should know when one is required and who is accountable for acting on its findings. The ICO's data sharing code of practice provides a useful reference point for UK organisations navigating these questions, particularly where public bodies or regulated services are involved.

The board should also ask how the agreement will be kept current. Partnerships evolve. New services, new systems and new subcontractors can change the data picture without a formal variation. A data-sharing agreement that is signed once and never revisited is a weak control.

Set access rules that reflect least privilege

Access is where governance becomes tangible. Boards should expect partners to operate on a least-privilege basis: people should see the information they need for their role, for the time they need it, and no more. Role-based access, time-limited permissions and clear approval routes are not bureaucratic extras. They are the practical expression of custody.

The board should also ask about the partner's own workforce. Are sub-processors or subcontractors involved? Are their staff subject to equivalent confidentiality and security expectations? Are access rights reviewed when roles change or when a secondment ends? In partnership settings, joiners and leavers can move between organisations quickly, and access rights can linger. A simple quarterly access review, reported to the partnership's governance group, is often more valuable than a detailed policy that no one applies.

Make security a board-visible expectation

Security expectations should be agreed at the outset and expressed in plain terms. This includes baseline controls, incident notification timelines, encryption standards, device management and expectations for remote working. The board should not assume that a partner's security posture matches its own. It should ask for evidence proportionate to the sensitivity of the data and the scale of the relationship.

Incident response deserves specific attention. Who notifies whom? Within what timeframe? Who speaks to affected individuals or regulators? A partnership that has not rehearsed these questions may find that a difficult situation is made worse by confusion over roles. The board should satisfy itself that there is a named contact on each side and a documented escalation route.

Decide the ending at the beginning

Shared data outlives many partnerships. The board should therefore require an exit plan before the relationship becomes embedded. What data will be returned, transferred or deleted? In what format? Who confirms deletion, and what evidence is provided? What happens to backups, archives and management information derived from shared data? Are there statutory retention obligations that prevent immediate deletion?

These questions are easier to answer while the relationship is constructive. They are much harder to negotiate when trust has eroded or when a partner is leaving under pressure. The board should treat exit planning as part of the original design, not as a closing formality. It is also a relationship issue: a clear exit plan reduces suspicion and allows partners to focus on delivery rather than on protecting themselves.

Assurance: ask for evidence, not anecdotes

The board's final responsibility is assurance. It should receive regular, concise reporting on data governance in material partnerships: access reviews completed, incidents and near misses, training completion, outstanding actions from assessments, and progress on exit planning. Metrics should be few enough to be read and specific enough to prompt a question.

A proportionate rule set will differ by sector and scale. But the underlying principle is consistent. Where information is shared, custody must be visible. The board that can explain who holds the data, why they hold it, who can see it and how it will be returned is better placed to protect the organisation, the people whose information it holds, and the partnership itself.