 determine your lawful basis before you begin processing, and you should document it. The ICO has published an interactive guidance tool36 to help you determine the lawful basis on which you need to share data. Legal Obligation Legal obligation provides a lawful basis where the processing of information is necessary in order to comply with the law. This will not apply to contractual obligations. This does not mean that there must be a legal obligation requiring the specific processing activity. The point is that your overall purpose must be to comply with a legal obligation which has a sufficiently clear basis in either common law or statute. Legitimate Interests This is a lawful basis for processing personal data, which may be appropriate for organisations in the private and voluntary sectors. Sharing information under this basis is likely to be used in situations where you need to use an individual’s personal data in ways people would reasonably expect and which are low-risk and will not have a big impact on them. Personal Data (or personal information) Personal data37 (or personal information) is information that relates to an identified or identifiable living individual. An identifiable individual means a person who can be identified directly or indirectly in particular by reference to: 34 Data sharing agreements | ICO 35 Lawful basis for processing | ICO 36 Lawful basis interactive guidance tool | ICO 37 What is personal data? | ICO 25 a) an identifier such as a name, an identification number, location data or an online identifier; or b) one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of the individual. Practitioner An individual working with children and young people who makes decisions about shar