227Contents of data access agreement

227 Contents of data access agreement (1) A data access agreement must include the following information: (a) a detailed description of the data that the data provider will give to the CEO; (b) how the data will be accessed, used, interpreted, linked and secured; (c) the categories of users who may access the data and any conditions upon their access; (d) any restrictions on the access, use or interpretation of the data; (e) what happens if a data provider no longer owns the data it is required to share under the agreement; (f) what happens if a party breaches the agreement; Care and Protection of Children Act 2007 139 (g) the period for which the agreement is in force; (h) how the agreement may be terminated. (2) A data access agreement may permit the CEO, or a user authorised under the terms of a data access agreement, to only access, use, interpret or link data obtained under an agreement for the purpose of exercising powers or performing functions under this Act. (3) A data access agreement must make provision for the agreement to be reviewed at least once every 5 years to ensure the sharing of information under the agreement meets the criteria in section 226(2). (4) A data access agreement may include other conditions the parties to the agreement consider appropriate.