Skip to content

Research, planning and audit

These purposes are usually beyond individual care even when undertaken by an NHS organisation or by someone who also provides care.

Pattern

  1. State and separate the purpose; do not rely on a direct-care access pathway by convenience.
  2. Prefer anonymous information where it can achieve the purpose.
  3. Identify controller functions, Article 6 and Article 9 conditions, DPA Schedule 1 safeguards and research/public-interest conditions as applicable.
  4. Establish a separate confidentiality route for CPI.
  5. Apply the Type 1 opt-out to identifiable GP data leaving the practice/system and the national data opt-out to in-scope later uses/disclosures unless a current exception applies.
  6. Screen for a DPIA and complete it before likely high-risk processing; use specialist governance/ethics/CAG routes where applicable.
  7. Restrict linkage, access, outputs, retention, onward use and re-identification.
  8. Publish meaningful transparency and review the flow as law, purpose, participants or technology change.

Service evaluation and audit labels do not determine the legal answer by themselves. The actual purpose, effect, controller function, data and people affected determine the route.

See the beyond-care sharing route, opt-outs and section 251, and data protection and transparency.

Evidence: SRC-001, SRC-002, SRC-007, SRC-008, SRC-009, SRC-033.