21. (1) A data-sharing agreement shall specify a party (in this Act referred to as the “lead agency”) to that agreement to be responsible for carrying out the functions set out in subsection (3).

(2) Subject to section 38(1)(e) and in default of agreement, the lead agency in respect of a data-sharing agreement shall—

(a) where one of the parties only to the data-sharing agreement is a controller in respect of the information being or to be disclosed under that agreement, be that party, and

(b) where more than one party to the data-sharing agreement is a controller in respect of the information being or to be disclosed under that agreement, be the controller nominated by those controllers to be the lead agency in respect of that agreement.

(3) The lead agency shall—

(a) where a public body that was not a signatory to the data-sharing agreement concerned on its date of execution accedes to the agreement in accordance with section 18 or where a party withdraws from the agreement, update the schedule referred to in section 19(1)(a),

(b) notify the parties to the data-sharing agreement concerned of any changes to the schedule referred to in section 19(1)(a),

(c) where a party that was the lead agency withdraws from the data-sharing agreement concerned, amend the agreement accordingly, and

(d) publish a copy of the conclusions of a review of the data-sharing agreement concerned carried out under section 20 on a website maintained by it or on its behalf.

(4) Where information in respect of a person is, or is believed by the person to be, included in the information disclosed or to be disclosed under a data-sharing agreement, that person may direct a request in relation to the exercise of a right of that person under Article 15, 16, 17, 18, 20 or 21 of the General Data Protection Regulation in respect of that information to the lead agency specified in that data-sharing agreement.

(5) Where a lead agency receives a request in accordance with subsection (4), the lead agency shall—

(a) where the lead agency is not a controller in respect of the information concerned, send the request to the controller, or

(b) where the lead agency is a joint controller (within the meaning of Article 26 of the General Data Protection Regulation) in respect of the information concerned, send the request to the other joint controller,

as soon as practicable following receipt of the request.