Skip to content

Data protection and transparency

Required analysis

For personal health data, record:

  • an Article 6 lawful basis for each controller;
  • an Article 9 condition;
  • any applicable DPA Schedule 1 condition and required policy document;
  • purpose compatibility for any reuse;
  • fairness, necessity, proportionality and minimisation;
  • privacy information and rights handling;
  • processor, joint-controller and international-transfer arrangements;
  • security, retention, deletion and incident controls;
  • DPIA screening and a completed DPIA before likely high-risk processing.

Evidence: SRC-001, SRC-002, SRC-005.

Data (Use and Access) Act position

The Data (Use and Access) Act 2025 amends rather than replaces UK GDPR and DPA 2018. The ICO states that all DUAA data-protection provisions were in force by 19 June 2026. Changes include areas such as research, public-task disclosures, subject-access searches, automated decisions and controller complaints. SRC-003 SRC-004

The ICO Data Sharing Code is a statutory code but currently carries an explicit notice that it is under review following DUAA. Its stable controls—documented purpose, roles, lawful basis, DPIA, agreement, transparency, security and review—remain useful. Clause-level interpretations affected by DUAA are tracked for revalidation. SRC-005

Agreements

Use the arrangement matching the actual role:

  • controller-to-controller data-sharing agreement as strong, normally expected governance for routine/systematic sharing;
  • Article 26 joint-controller arrangement where purposes and means are jointly determined;
  • Article 28 processor contract where a processor acts on documented instructions;
  • commissioning, service and supplier terms supporting—but not substituting for—the legal analysis.

Articles 26 and 28 impose role-specific legal requirements. A controller-to-controller sharing agreement is highly recommended and may be contractually or locally required, but is not a universal statutory precondition for every one-off disclosure. No agreement can legalise a flow that lacks authority.