 develop your own template and process to suit your particular needs. However, the ICO website provides a template for you to use. A previous or existing DPIA might also help you to prepare your new DPIA, if it covered a similar processing operation. Seek advice from your organisation’s designated safeguarding children professional, the Data Protection or Information Governance leads (e.g., Data Protection Officer), Caldicott Guardian, Professional Regulator (if applicable) or your organisation’s relevant policy or legal team for further advice. 32 Data Protection Impact Assessments (DPIAs) | ICO 33 Example DPIA template can be found on the ICO website at https://ico.org.uk/media/for- organisations/documents/2553993/dpia-template.docx 24 Data Sharing Agreements (DSA) Data Sharing Agreements (DSA)34, also known as Information sharing agreements (ISA), are not mandatory but are good practice and helpful to all parties with whom or which you share information. Drawing up an agreement helps ensure everyone is clear about what information is or will be shared, and how it will be done. Lawful basis You must have a valid lawful basis35 in order to process personal data. Article 6 UK GDPR provides six lawful bases for processing. No single basis is ’better’ or more important than the others – which basis is most appropriate to use will depend on your purpose, the type of organisation you work for, and your relationship with the individual. Most lawful bases require that processing is ‘necessary’ for a specific purpose. If you can reasonably achieve the same purpose without the processing, you will not have a lawful basis. You must determine your lawful basis before you begin processing, and you should document it. The ICO has published an interactive guidance tool36 to help you