Key terms

These are plain-language working meanings. Follow the linked legal and evidence pages where a decision depends on an exact definition.

Term	Plain-language working meaning
Applicable instrument	A candidate instrument whose jurisdiction, purpose, organisations, direction, workflow, scope, version and date have been checked and recorded as applying to the defined flow.
Anonymous information	Information that is not personal data because no person is identifiable by reasonably likely means. Context and the recipient’s capability matter. Creating anonymous output can still involve processing personal or confidential information.
Baseline control	A current requirement that applies to every in-scope flow of the stated kind, such as data-protection and accountability requirements where personal data are processed.
Beyond direct care	Research, planning, commissioning, audit, service management, population health or another purpose that is not the care of an identified person. Being inside the NHS does not turn such a purpose into direct care.
Caldicott Guardian	A senior person who supports appropriate use and protection of health and care information. The controller remains accountable for its decision.
Candidate instrument	Legislation, a regulation or duty, standard, confidentiality rule, contract, guidance or another control that may govern a workflow but has not yet passed the flow-specific applicability test.
Confidential patient information (CPI)	Patient information subject to confidentiality. The statutory definition used for section 251, the Control of Patient Information Regulations and opt-outs must be checked for the flow.
Confidentiality consent	A person’s permission to use or disclose information given in confidence. It is not automatically the same as consent used as a UK GDPR lawful basis.
Controller	A person or organisation that decides why and how personal data are processed. Joint controllers make those decisions together.
COPI Regulations	The Health Service (Control of Patient Information) Regulations 2002. Their exact regulation, purpose, people, conditions and duration determine whether they support a use of CPI.
Data flow	A defined movement or use of information: who sends what, to whom, about which person or population, for what purpose, and with what benefit.
DCB or DAPB standard	An NHS information standard or collection with an identifier. Its notice, scope, status, version and dates determine whether it applies.
Direct or individual care	Care, diagnosis, treatment or support of an identified person. Sharing still needs a current care relationship, relevant role, necessary information and every applicable legal and safety check.
DPIA	Data protection impact assessment. It must be completed before processing likely to create a high risk and can support proportionate design and accountability for other significant flows.
DSPT	Data Security and Protection Toolkit. It supports organisational assurance; a completed return does not by itself prove that a particular data flow is lawful or safe.
Governing instrument	The umbrella term in this wiki for legislation, regulations and statutory duties, standards, confidentiality rules, contracts, guidance and other controls that can affect a PHC information flow.
Information Standards Notice (ISN)	The authoritative notice stating the organisations, systems, flow, version, implementation and conformance details for an NHS information standard.
Jurisdiction	The country and legal or health-service system whose law, regulations, standards, contracts and policy govern the flow. UK-wide data law does not make every England-specific health rule UK-wide.
Lawful basis	The UK GDPR Article 6 basis for processing personal data. Special-category health data also need an Article 9 condition; confidential information separately needs a confidentiality route.
National data opt-out	A choice that can prevent a person’s confidential patient information being used or disclosed for specified purposes beyond individual care. It is separate from the Type 1 opt-out.
Personal data	Information relating to an identified or identifiable living person. Health data are usually also special-category data.
PHC	Primary health care. This wiki focuses principally on general practice and connected primary-care services.
Processor	A person or organisation that processes personal data for a controller on documented instructions rather than deciding its own purpose.
Pseudonymised data	Personal data altered so it cannot be attributed without additional information kept separately. It normally remains personal data for a party able to re-identify.
Section 251	The NHS Act 2006 regulation-making route implemented through the COPI Regulations for certain processing of CPI without consent. Apply the exact regulation and conditions; purpose-specific approval is needed only where that route requires it.
Section 251B	A qualified duty on relevant health and adult-social-care bodies to share information likely to facilitate an individual’s care when sharing is in their best interests, subject to statutory limits.
Special-category data	Personal data types, including health data, that receive additional UK GDPR protection and need an Article 9 condition as well as an Article 6 basis.
Standards Directory	NHS England’s discovery service for published and future standards. A listing or “Active” label alone does not prove that a standard is mandatory for a particular flow.
Type 1 opt-out	A choice that prevents identifiable GP record data leaving the practice or GP system for purposes beyond direct care. It is distinct from the national data opt-out.