Intra-Group Data Sharing and Transfers

No group privilege: the starting point for intra group data sharing

Intra group data sharing in Germany starts from a simple premise: German and EU data protection law does not recognise a "group privilege". Each company in a group is a separate controller or processor, and every transfer of personal data from one group company to another needs a legal basis, transparency towards data subjects and, where the recipient sits outside the European Economic Area, a transfer mechanism.

Intra group data flows — shared HR systems, central IT, group-wide CRM, compliance investigations, shared service centres — are therefore subject to the same rules as transfers to third parties, with some recognition of group interests. Recital 48 of the General Data Protection Regulation (GDPR) acknowledges that controllers in a group may have a legitimate interest in transmitting personal data within the group for internal administrative purposes, including data of customers and employees; the rules on transfers to third countries remain unaffected.

Getting this governance right matters more than many groups expect. Supervisory authorities scrutinise group HR systems and central customer databases; works councils have co-determination rights over group-wide IT systems; and in transactions and restructurings, unclear data roles cause delays. A clear framework — usually an intra group data agreement combined with internal policies — makes compliance manageable.

Allocating roles: controller, joint controller or processor

The first step is to determine, for each intra group processing activity, which entity decides on the purposes and means of processing:

• Processor arrangements (Article 28 GDPR): a group IT company or shared service centre processes data on behalf of the operating companies, following their instructions. A data processing agreement is required.
• Joint controllership (Article 26): two or more group companies jointly determine purposes and means — for example a group-wide CRM where the parent and subsidiaries decide together how customer data are used. They must agree on their respective responsibilities, make the essence of the arrangement available to data subjects and remain individually liable towards data subjects.
• Separate controllers: a group company receives data for its own purposes — for example the parent receiving employee data for group-wide talent management or compliance. The disclosing company needs a legal basis, and the recipient becomes responsible for its own processing.

The Court of Justice has interpreted joint controllership broadly: entities can be joint controllers even if they do not have equal responsibility or access to the data, and a formal arrangement is not a prerequisite for joint controllership — but where it exists, joint controllers must conclude the arrangement required by Article 26. Misclassifying a joint controllership as a processor arrangement is a common error, and it matters because processors may not use data for their own purposes and joint controllers carry their own liability.

Legal bases for intra group data transfers

The legal basis depends on the data and purpose:

1. Employee data: processing must be necessary for the employment relationship or based on another Article 6 ground. The German special provision in § 26 of the Federal Data Protection Act (BDSG) has been limited in its effect by the Court of Justice's judgment of 30 March 2023, C-34/21, so employers increasingly rely directly on Article 6 GDPR and on works agreements meeting Article 88(2) GDPR. See our insight on employee data protection after the CJEU.
2. Customer data: contract performance where group companies jointly provide services; legitimate interests for internal administration, group-wide fraud prevention or central customer service, subject to a balancing test; consent where required, for example for certain marketing.
3. Compliance and legal obligations: processing necessary to comply with legal obligations under EU or German law; for group-level compliance, often legitimate interests.
4. Special categories: health data and other sensitive data require an Article 9 condition, which is often lacking for group purposes.

Legitimate interests require documented balancing. Recital 48 helps, but it does not replace the assessment: the more sensitive the data and the less expected the sharing, the harder it is to justify. Safeguards such as pseudonymisation, access restrictions to specific functions and short retention periods tip the balance in favour of the group, and data subjects' right to object must be respected.

International transfers within the group

For transfers to group companies outside the EEA, Chapter V GDPR applies. Options include:

• Binding corporate rules (BCRs, Article 47): group-wide rules approved by the competent supervisory authority, binding on all group entities and enforceable by data subjects. BCRs take time to approve but provide a robust framework for groups with extensive transfers.
• Standard contractual clauses: often implemented through an intra group data transfer agreement to which all group companies accede, combined with transfer impact assessments.
• Adequacy decisions: for group companies in adequate countries, including DPF-certified US affiliates within the scope of their certification.

See our insight on international data transfers after the Data Privacy Framework.

Transparency towards data subjects

Data subjects must be informed which group companies receive their data, for what purposes and on what legal basis (Articles 13 and 14 GDPR). Group privacy notices should name the categories of recipients within the group and explain joint controllership arrangements, including the essence of the Article 26 arrangement. For employees, information is often provided through an HR privacy notice and the works agreement. Vague references to "affiliated companies" without purposes are a frequent subject of authority criticism.

Data subject requests and breaches across the group

When a data subject exercises rights — access, deletion, objection — the request may concern data held by several group companies. The intra group arrangements should define who responds, how data are collected from other entities and within which internal deadlines, so that the one-month deadline under Article 12 GDPR is met. Similarly, a data breach at a group IT provider affects all companies whose data it processes. The agreement should require prompt internal notification, allocate responsibility for notifying authorities and data subjects, and set up a joint incident team. See our insight on data breach notification.

The intra group data agreement

Most groups bundle the necessary documents into a single framework agreement: a framework agreement to which group companies accede, containing modules for processor relationships, joint controllership arrangements, controller-to-controller transfers and standard contractual clauses for third-country transfers. Annexes list processing activities, roles and technical and organisational measures. A governance chapter allocates responsibilities for data subject requests, breach notification and cooperation with authorities. The agreement should be easy to update when group structures change.

Common mistakes

Several errors recur in group data structures. Groups treat their IT subsidiary as a processor although it decides on purposes, for example by analysing usage data for its own security purposes. Parent companies access subsidiaries' customer data for group marketing without a legal basis or transparency. HR data flow to non-EEA headquarters under SCCs that were never signed by the German employer. Joint controller arrangements exist on paper but do not reflect who actually handles data subject requests. And documentation lags behind the group structure after acquisitions or reorganisations, so that entities that no longer exist remain parties while new ones are missing.

A periodic review — at least annually and after every structural change — avoids these problems. It should compare actual data flows with the documented roles and legal bases, update the list of acceding entities and check that transfer tools and impact assessments are still current. Internal audit or the data protection officer can run the review with input from IT and HR.

Works councils and group-wide systems

Introducing or changing technical systems capable of monitoring employees' behaviour or performance requires the works council's agreement under the Works Constitution Act. For group-wide systems, the group works council may be competent. Works agreements can also serve as a legal basis for employee data processing if they meet the requirements of Article 88(2) GDPR. Early involvement of the works council avoids delays. See our page on works councils.

Group compliance, investigations and whistleblowing

Group-wide compliance functions often need data from subsidiaries — for example in internal investigations, sanctions screening or whistleblowing cases handled centrally. German law allows employers in groups to use a central internal reporting office under the Whistleblower Protection Act, but the responsibility for remedying violations remains with the employing entity, and confidentiality of the whistleblower's identity must be preserved across the group. Investigation data should be shared only to the extent necessary, with clear roles and retention periods. See our insight on employee interviews in internal investigations.

Data protection officers and governance in groups

A group may appoint a single data protection officer for several group companies, provided the officer is easily accessible from each establishment (Article 37(2) GDPR). German rules on when a data protection officer is mandatory apply per entity. A group data protection organisation with local coordinators, a central policy framework and regular reporting to management makes intra group data compliance sustainable. See our insight on data protection officers in Germany.

Restructurings, carve-outs and transactions

Data flows change when groups restructure. Carve-outs require transitional services agreements that cover data processing roles and transfers until the separated business has its own systems. Mergers and integrations require new legal bases and privacy notices for data previously held by separate companies. In M&A due diligence, buyers should review the target's group data arrangements and dependencies on seller systems.

Where an acquired company joins the group, it should accede to the group framework agreement promptly and its existing data flows should be mapped against the group's roles and legal bases before systems are integrated. Customer data acquired in asset deals can only be transferred to the buyer where a legal basis exists, which often requires a careful assessment of legitimate interests and objection rights.

How TRW & Co helps with intra group data sharing

We advise groups on structuring intra group data sharing and transfers: mapping data flows, allocating controller and processor roles, drafting intra group data agreements and joint controller arrangements, implementing SCCs and binding corporate rules, and negotiating works agreements for group-wide systems. We also support carve-outs and integrations. See our page on GDPR and data protection or contact us.