WASPI UK GDPR Code of Conduct: What It Means for Public Service Data Sharing

The ICO has approved a UK GDPR code of conduct for information sharing between public services in Wales. The Wales Accord on the Sharing of Personal Information (WASPI) code was approved on 24 September 2026 and announced on 28 September 2026.

What happened?

WASPI is an existing framework that helps organisations in Wales share personal information safely. More than 1,000 organisations are already signed up to it, according to the ICO.

Its new code of conduct has now been approved under Article 40 of the UK GDPR. A code of conduct is a set of sector rules, approved by the regulator, that shows how data protection law applies in practice. Members who follow an approved code have a recognised way to show accountability. The ICO’s Chris Hogan described it as “a clear and recognised way to demonstrate accountability”.

The key facts, from the ICO’s register of codes:

• Reference: ICO-CC/002
• Approved: 24 September 2026
• Code owner: Digital Health and Care Wales
• Monitoring body: the WASPI Service, which is still pending ICO approval

What does the code cover?

The code covers sharing personal information to deliver health, education, social care, safeguarding and other public services to people in Wales.

Code members must:

• use the WASPI information sharing protocol (ISP) template, a standard document that sets out what is shared, why and how
• put governance controls in place
• go through a quality assurance process
• accept ongoing monitoring
• review their information sharing arrangements regularly

Who does it affect?

The code applies to organisations that share personal information to deliver public services in Wales and choose to sign up. That includes:

• schools and education providers
• social care providers
• local authorities
• health bodies
• housing providers
• charities and voluntary organisations working alongside public services

The code concerns information sharing for services to people in Wales. An organisation’s address alone does not decide eligibility: check the code’s membership criteria with WASPI, particularly for cross-border arrangements. Organisations elsewhere can still use its approach as a prompt to review their own practices.

Why does it matter?

Sharing information between services is where data protection often goes wrong. Some staff hold back information that should be shared, for example in a safeguarding case. Others share without a clear lawful basis or a written agreement.

A code gives everyone the same template and the same checks. That makes it easier for staff to share with confidence and easier for organisations to prove they got it right.

Does joining WASPI replace your UK GDPR responsibilities?

No. A code supports accountability; it does not supply a lawful basis for every disclosure or remove your responsibility to assess each sharing arrangement. Record the purpose, lawful basis, safeguards and responsibilities before sharing.

What should organisations do now?

If you work in Wales and already use WASPI:

• Check your information sharing protocols use the current WASPI template.
• Make sure each protocol has a named owner and a review date.
• Watch for the monitoring body’s approval. The regulator’s register still lists approval of the monitoring body as pending at the time of this review.

If you work in Wales and don’t use WASPI:

• List the organisations you regularly share personal information with.
• Consider whether joining the code would give you a clearer, consistent way to document that sharing.

If you work elsewhere in the UK:

• Review your data sharing agreements. Are they current, consistent and easy for staff to find?
• Compare them with the ICO’s data sharing code of practice, which applies across the UK.

For one-off requests, such as from the police, see our guide to ad-hoc data sharing requests.

How DPP can help

We support local authorities and schools, academies and colleges with data sharing agreements, DPIAs and day-to-day data protection advice. If you’d like a review of your information sharing arrangements, talk to our team about the support you need.

Discuss your information sharing arrangements

Sources and further guidance

WASPI entry in the ICO’s register of approved codes

Regulator announcement, 28 September 2026

Content reviewed: 2 October 2026.