Skip to content

Law and governance

No single rule answers whether a flow is lawful. Treat the following as cumulative layers:

  1. organisational function, statutory power or duty;
  2. UK GDPR lawful basis and, for health data, special-category condition;
  3. Data Protection Act 2018 conditions and safeguards where applicable;
  4. common-law confidentiality authority for confidential patient information;
  5. patient objection and national data opt-out rules;
  6. sector duties, binding information standards, contracts and professional obligations;
  7. necessity, fairness, transparency, security, safety and accountability.

The legislation and duties page maps primary legislation. Confidentiality and Caldicott separates the confidence test from data protection. Data protection and transparency records the UK GDPR/DPA/DUAA position. Opt-outs and section 251 handles beyond-care CPI.

The operational answer is recorded through the sharing route decision workflow, not inferred from a single citation.