The Welsh Agreement on the Sharing of Personal Information (WASPI) has published a code of conduct approved under article 40 of the UK GDPR, intended to regulate information sharing protocols.

This code of conduct aims to provide organisations with a framework for sharing personal data in a lawful, transparent and responsible manner. It is addressed to Welsh entities active in the health, education, social care, safeguarding and other public service sectors. The code establishes enhanced safeguards, including the mandatory use of the WASPI Information Sharing Protocol (ISP) template, ongoing monitoring, governance requirements and periodic review mechanisms. More than 1,000 organisations are already signatories to the WASPI agreement.

The UK GDPR code of conduct defines six key requirements: governance, use of approved templates, quality assurance, accountability, review of information sharing agreements and compliance with ongoing monitoring. These requirements aim to help participating organisations demonstrate their compliance with the core principles of the GDPR, such as lawfulness, transparency, accountability, security and data minimisation. Developed with the support of the Information Commissioner's Office (ICO), this code is the first in the UK to cover both public sector and third sector partners. The WASPI service will be established as an independent supervisory body.