Personal data should only be disclosed outside the Company where there is a legitimate business need, an overarching legal justification to do this or where a customer consents to such disclosure (whether as set out within a contract or otherwise in writing). Disclosure must be made on a strictly limited ‘need to know’ basis where there is clear justification for transferring personal data – either because the data subject has consented to the transfer or because it is for a legitimate business need.
Where personal data is transmitted outside the Company, for example to a service provider, a secure medium must be used to transmit such data and written agreements (containing the required level of security standards) should be in place with each such third party. In each case, data subjects must be aware that the transfer or disclosure is likely to take place to a third party. This should normally be achieved through the use of our End User Privacy Notice or Employee Privacy Notice (or other forms of privacy notice), except where the transfer or disclosure is clearly understood by the data subject as a necessary part of a function of the Company. Assurances should also be sought from the third party recipient that they will only use the personal data for legitimate / authorised purposes and keep it secure.
If a particular disclosure is required to meet a legal obligation (for example to a government agency or police force/security service) or in connection with legal proceedings, the personal data may be provided so long as the disclosure is limited to that which is legally required.