The Data Sharing Agreement (DSA) is an agreement between the MRIS (NHS IC) and the customer organisation which sets out the principles and standards related to the data. It sets out arrangements for the safeguarding and processing of information that both organisations will adopt.

The DSA must be signed by a person in the customer organisation who has responsibility for ensuring the ‘security and confidentiality' of the data. This could be the Caldicott Guardian, Information Security Officer or person with delegated authority. All members of the project team who access the data also need to sign a declaration of use.