Overview
A data sharing agreement (DSA) is a formal document that sets out the terms under which one organisation shares personal or other data with another. It typically covers:
what data is being shared
the legal basis for sharing it
how it will be used
security and retention requirements
the responsibilities of each party
The Hwb User Management Portal (UMP) includes a dedicated area for managing data sharing agreements. This area also allows schools and local authorities to:
select data controllers
view and agree to data sharing agreements
access agreement history and reporting
DSA types
A DSA can be provided to both a local authority and a school. The wording and meaning of the agreement may differ depending on the organisation and the services being used.
Each local authority and school must agree to its own DSA through an authorised data controller.
Organisations may have more than one type of DSA. This depends on the products being used and supplied. For example, a DSA for Hwb services, and a separate DSA for the use of Google Workspace.
Data controller roles
The UMP includes 4 data controller roles that approve and manage data sharing agreements.
At local authority level
Local Authority Principal Data Controller
Local Authority Data Controller
At school level
School Principal Data Controller
School Data Controller
Understanding each role
Principal data controller
Can agree to and administer all DSAs for that organisation.
Can promote members of staff with the relevant SWAC code to the role of data controller.
At LA level, this role can promote staff to data controllers at school level.
Can demote data controllers to remove their access to the DSAs.
Data controllers
Can agree to and administer all DSAs for that organisation.
At LA level, this role can promote staff to data controllers at school level.
Data controller promotion rules
Users can be promoted to the role of data controller or principal data controller in the following scenarios:
a user with the role Local Authority School Administrator can be promoted to Local Authority Principal Data Controller only by a Welsh Government Administrator.
a user with the role Local Authority School Administrator can be promoted to Local Authority Data Controller by a Local Authority Principal Data Controller.
a user with the SWAC role of EH, HT, AC, DH or AH (in that order of precedence) will be automatically assigned the role of School Principal Data Controller by the system, based on the school's MIS data.
a user with the SWAC role of EH, HT, AC, DH or AH can be selected as a School Data Controller by a School Principal Data Controller.
a user with the SWAC role of EH, HT, AC, DH or AH, or a role starting with the SWAC codes QT or BM, can be promoted to School Data Controller by their Local Authority Principal Data Controller or Local Authority Data Controller.
Current role or SWAC role | Can be promoted to | By | Manual or automated process |
Local authority school administrator | Local authority principal data controller | Welsh Government administrator | Manual |
Local authority school administrator | Local authority data controller | Local authority principal data controller | Manual |
EH, HT, AC, DH or AH. In order of precedence | School principal data controller | The information in the school’s MIS | Automated through the MIS |
EH, HT, AC, DH or AH | School data controller | School principal data controller | Manual |
EH, HT, AC, DH or AH, or starting with codes QT or BM | School data controller | LA data or principal data controller | Manual |
Local authority guidance
Sign a DSA at local authority level
You need to be a Local Authority Principal Data Controller or Local Authority Data Controller to sign a DSA for your local authority.
Go to the Local Authority DSA Overview page. You can do this in one of 2 ways:
use the notification at the top of the page, which will warn you if there's a DSA that needs to be approved. Selecting Sign on the notification will take you to the DSA overview page
go to the page via the local authority dashboard administration menu, under Local Authority DSA Overview
Select Manage on a DSA marked Unsigned.
On the pop-up, you can read the DSA text and download it as a PDF if needed.
Tick the box to confirm I <username> agree to the terms.
Select I agree.
The tile on the Local Authority DSA Overview page will now show that DSA type as signed.
Promote a Local Authority School Administrator to Local Authority Data Controller
You need to be Local Authority Principal Data Controller to do this.
As a Local Authority Principal Data Controller, go to your local authority dashboard.
Select <local authority name> Administration to open the administration menu.
Select Local Authority DSA Overview to open the DSA overview for your local authority.
In the Users that can be promoted table, select the user you want to make a data controller, then select Promote. Only active users with a Local Authority School Administrator role for this local authority will appear in this table.
The promoted user will now appear in the Users with data controller role table. You can use this table to demote the user in future if needed, by selecting Demote next to their name.
Promote a School Data Controller as a Local Authority Principal or Data Controller
You need to be a Local Authority Principal Data Controller or Local Authority Data Controller to do this.
To promote a user with the SWAC role of EH, HT, AC, DH or AH, or a role starting with the SWAC codes QT or BM, to School Data Controller:
Go to your local authority dashboard.
Find the target school and select View details to open that school's dashboard.
From the school's dashboard, select Administration to open the administration menu.
Select DSA Overview to open the DSA overview for that school.
In the Users that can be promoted table, select the user you want to make a data controller, then select Promote. Only active users with a SWAC role of EH, HT, AC, DH or AH, or a role starting with the SWAC codes QT or BM, will appear in this table.
The promoted user will now appear in the Users with data controller role table. You can use this table to demote the user in future if needed, by selecting Demote next to their name.
View DSA reporting for schools in your local authority
You need to be a Local Authority Principal Data Controller, Local Authority Data Controller, Local Authority Administrator, or Local Authority School Administrator to do this.
As a Local Authority Principal Data Controller, Local Authority Data Controller, Local Authority Administrator or a Local Authority School Administrator, go to your dashboard.
Select <local authority name> Administration to open the administration menu.
Select Local Authority DSA Overview. This screen displays the progress of all the schools in that LA in agreeing to the DSA.
Select the Schools tab to view DSA records for schools within your local authority.
Use the dropdown below the Local Authority Overview heading to switch which DSA information you're viewing. Wording changes and versioning are grouped under the same DSA type.
Use the filter bar to filter by school name or ID.
Select a column heading to sort the table.
Select a school in the table to view its historical signing record.
Select Download historical data to download the data as a CSV. If you've selected a specific school, the CSV will only contain data for that school. If no school is selected, the CSV will contain data for all schools in your local authority.
Check a DSA's signing history as a local authority principal or data controller
You need to be a Local Authority Principal Data Controller or Local Authority Data Controller to do this.
Go to your local authority dashboard.
Select <LA name> Administration to open the administration menu.
Select Local Authority DSA Overview.
On the tile for the DSA type you want to check, select View history.
DSA notifications for local authorities
Overview
Notifications help you manage your Data sharing agreements (DSAs). You will be alerted when a DSA needs signing by your local authority or when a school needs support.
Sign a DSA
When a DSA goes live for your local authority, you'll see a yellow notification prompting you to sign it. If the deadline date passes and the DSA is still unsigned, the notification turns red and is prefixed Urgent, to flag that action is overdue.
Select Sign DSA on either notification to go and sign it.
Who sees this: Local Authority Principal Data Controller, Local Authority Data Controller.
A DSA has changed
If a DSA's terms change (for example, following an update to the agreement), you'll be asked to re-sign an updated version. As soon as the updated version goes live for your local authority, you'll see a yellow notification prompting you to sign it. If the deadline date passes and it's still unsigned, the notification turns red and is prefixed ‘Urgent’.
Select Sign DSA on either notification to go and sign it.
Who sees this: Local Authority Principal Data Controller, Local Authority Data Controller.
Schools without a data controller
If a school in your local authority doesn't have a data controller assigned, you'll see a notification when you log into the UMP.
Select View to see which schools are affected. This notification stays visible until every school in your local authority has been assigned at least one principal data controller or data controller. The LA can then assign one or advise the school to assign a qualifying SWAC role in their MIS if one has not been selected by the system.
Who sees this: Local Authority Principal Data Controller, Local Authority Data Controller.
Schools with an unsigned DSA
If a school in your local authority hasn't signed a DSA by its deadline date, you'll see a notification with a link to guidance on next steps.
Who sees this: Local Authority Administrator, Local Authority School Administrator, Local Authority Principal Data Controller, Local Authority Data Controller.
School guidance
Sign a DSA at school level
You need to be a School Principal Data Controller or School Data Controller within the school to sign a DSA.
Go to the DSA Overview page. You can do this in one of 2 ways:
use the notification at the top of the page, which will warn you if there's a DSA that needs to be signed. Selecting Sign on the notification will take you to the DSA overview page
go to the page via the school dashboard administration menu, under Local Authority DSA Overview
Select Manage on a DSA marked Unsigned.
On the pop-up, you can read the DSA text and download it as a PDF if needed.
Tick the box to confirm I <username> agree to the terms.
Select I agree.
The tile on the DSA Overview page will now show that DSA type as signed.
Promote a School Data Controller as a School Principal Data Controller
You need to be School Principal Data Controller within the school to do this. To select a user with the SWAC role of EH, HT, AC, DH or AH as a School Data Controller:
Go to your school dashboard.
Select Administration to open the administration menu.
Select DSA Overview to open the DSA overview for your school.
In the Users that can be promoted table, select the user you want to make a data controller, then select Promote. Only active users with a SWAC role of EH, HT, AC, DH or AH will appear in this table.
The promoted user will now appear in the Users with data controller role table. You can use this table to demote the user in future if needed, by selecting Demote next to their name.
Check a DSA's signing history as a School Principal or Data Controller
You need to be a School Principal Data Controller or School Data Controller to do this.
Go to your school dashboard.
Select Administration to open the administration menu.
Select DSA Overview.
On the tile for the DSA type you want to check, select View history.
DSA notifications for schools
Overview
Notifications within the UMP alert you when a DSA needs signing at your school.
Sign a DSA
When a DSA goes live for your school, you'll see a yellow notification prompting you to sign it. If the deadline date passes and the DSA is still unsigned, the notification turns red and is prefixed Urgent to flag that action is overdue.
Select Sign DSA on either notification to go and sign it.
Who sees this: School Principal Data Controller, School Data Controller.
A DSA has been updated
If a DSA's terms change (for example, following an update to the agreement), a new version will be added, and you will be asked to agree to that version. As soon as the updated DSA goes live for your school, you'll see a yellow notification prompting you to sign it. If the deadline date passes and it's still unsigned, the notification turns red and is prefixed Urgent.
Select Sign DSA on either notification to go and sign it.
Who sees this: School Principal Data Controller, School Data Controller.
Tuesday, 27 October 2026