Applicability map
Start with the activity and data flow. “Healthcare data” describes a subject; it does not determine every legal duty. A supplier may perform several roles across hosting, support, analytics and model training. The matrix below identifies the facts that activate each layer. Read each linked chapter before making an applicability decision.
Make DSPT an early decision for NHS patient information or system access. Verify the applicable requirement and organisational assurance alongside the legal grounds. Direct receipt of records can matter without a live NHS connection. Private ownership or funding alone does not establish an exemption. SRC-056, SRC-081
For a commissioned recruitment service receiving identifiable records directly from NHS GPs, the recommendation is to require DSPT contractually. The worked decision explains why. Use the matrix to identify existing duties as well; “should be mandatory” and “already legally required” need different evidence.
Map both directions explicitly: the requester sends the request; the provider sends the information. The requester must establish its processing responsibilities even if the provider imposes no written conditions. Use requester readiness alongside this matrix, then support the provider's separate disclosure decision. SRC-098, SRC-103
| Layer | Trigger to test | Nature of obligation | Evidence to retain |
|---|---|---|---|
| UK GDPR and DPA | Personal data in territorial/material scope; health information engages Article 9 | Direct legal duties | Purpose, Article 6 basis, Article 9 condition, relevant DPA safeguards |
| Confidentiality | Information received in circumstances importing confidence | Common law plus relevant statutory gateways | Disclosure/use authority, scope and recipient restrictions |
| DUAA amendments | The amended provision and its commencement apply | Changes to existing law; some additional provisions | Current text, operative date and transition analysis |
| DPIA and risk assessment | Article 35 and published mandatory triggers; otherwise processing likely to result in high risk | Controller duty before processing; the stated recruitment flow engages the opportunity/special-category trigger | Applicable assessment, controller ownership, safeguards, residual-risk action and any claimed exception. SRC-018, SRC-100 |
| Agreements and policy documents | Actual controller/processor relationship and selected special-category condition | Article 28 terms, Article 26 arrangements and APDs where required; separate-controller sharing agreements are generally good practice unless another requirement applies | Role decision, applicable executed terms, condition-specific APD and proportionate evidence. SRC-014, SRC-015, SRC-002, SRC-099 |
| DSPT: NHS data assurance | NHS patient information or system access; relevant contract, disclosure terms or regulatory status | Organisational assurance required through applicable policy, standards, contracts or access conditions | Legal entity, assessment period, status, service coverage, audit and renewal arrangements |
| Other NHS standards and product assurance | Relevant information standard, digital health product, role and commissioning context | Scoped statutory standards, product assessment and contract | Applicable notice, intended use, DTAC evidence where relevant and access terms |
| Research | Activity is research; design and data determine approvals | Research safeguards plus conditional approval duties | Sponsor classification, approvals, protocol and conditions |
| Clinical safety | Health IT and deployment within applicable standard scope | Scoped information standards and contractual duties | Scope rationale, manufacturer/deployer responsibilities and safety evidence |
| Medical device | Software’s intended medical purpose and function | Product regulation | Qualification decision and required device documentation |
| Employment or insurance | Defined reports, workplace processing or decisions | Purpose-specific law and professional duties | Report rights, necessity, recipient basis and discrimination assessment |
| Other digital-service rules | Tracking, marketing, children, regulated cyber services or cross-border reach | Separate legal or regulatory conditions | Documented trigger and appropriate controls |
Turn the applicability map into a decision
For each layer, record one of applies, does not apply, or not yet established, with the reason and evidence. Separately mark any proposed contract condition. These are recommended recording categories. An unresolved statutory route must not silently become either an exemption or an existing obligation.
For DSPT, identify the exact source of the requirement, the covered entity and the required evidence. A purchaser can decide to require DSPT expressly while checking whether another duty already applies.
A practical order of assessment
- Identify the requester and sending provider, individual, fields, intended outcomes and access locations.
- Separate each purpose. Storage, support, evaluation and product improvement may need different analysis.
- Determine controller, joint-controller and processor roles from actual decisions, independently of who sends a document.
- Establish the recipient's processing grounds and the provider's disclosure authority, including confidentiality.
- Complete required DPIAs and role-specific arrangements before the relevant processing. Implement the identified safeguards.
- Verify DSPT requirements and coverage for NHS flows; add research, product and other sector requirements where triggered.
- Prepare evidence for the provider's disclosure decision. Record separate owners for recipient readiness, disclosure and continuing review.
This sequence combines the legal framework, confidentiality route and lifecycle duties. It is a review method, not a substitute for the legal tests.
Boundaries that commonly change the answer
- An external cloud host can process for direct care; an in-house research team can process for purposes beyond individual care. Purpose is decisive. SRC-037
- Identifiable private-sector health data can engage UK GDPR even where NHS-specific assurance does not apply. See the legal framework.
- Pseudonymisation is a safeguard, not an automatic exit from personal-data or CPI rules. SRC-029
- Secondary use may include health-service management that can meet a health-purpose condition; it is not automatically consent-only. See Article 9 conditions.
- Consent, a supplier contract, DTAC assessment or a security certificate cannot replace the other necessary authorisations. See NHS standards and confidentiality.
The validation queue retains application-specific decisions. Clarified example flows inform recommendations; no actual contract, dataset or complete service has been assessed.