| EV-DATA-001: UK GDPR scope follows processing and territorial links; purposes beyond individual care are not exempt. |
SRC-001 |
Supported |
No specific service data flow assessed. |
| EV-DATA-002: Health-data processing requires Article 6 and Article 9 justification plus applicable DPA safeguards. |
SRC-002 SRC-003 SRC-004 |
Supported |
No lawful basis or condition selected for an actual purpose. |
| EV-DATA-003: Article 9(2)(h) can cover occupational medicine and health-system management with the required safeguards. |
SRC-002 SRC-003 |
Supported |
Not every commercial health-data purpose qualifies. |
| EV-DATA-004: Pseudonymised data remains personal data for parties able to identify people; recipient anonymity is contextual. |
SRC-023 |
Supported |
Anonymity of any actual dataset has not been tested. |
| EV-DATA-005: Inferred health status and revealing service metadata can be special-category data. |
SRC-024 |
Supported |
Not every generic appointment or technical event is health data. |
| EV-DATA-006: Relevant DUAA reforms commenced 5 February 2026 and complaints provisions 19 June 2026. |
SRC-007 |
Supported |
Earlier activities may engage transitional and saving provisions. |
| EV-DATA-007: Regulator functions transferred to the Information Commission on 30 September 2026. |
SRC-008 |
Supported |
Website branding remains ICO. |
| EV-DATA-008: Current UK GDPR contains recognised legitimate interests in Article 6(1)(ea). |
SRC-004 |
Supported |
Restricted to Annex 1 and not an Article 9 condition. |
| EV-DATA-009: Research safeguards now sit in Articles 84A–D, including necessity, minimisation and individual-decision restrictions. |
SRC-002 SRC-003 SRC-009 SRC-010 |
Supported |
Actual research status, public interest and approvals remain unresolved. |
| EV-DATA-010: Articles 22A–D replace old Article 22; significant solely automated special-category decisions retain strict restrictions. |
SRC-011 SRC-012 SRC-013 |
Supported |
Actual significance and meaningful human involvement are fact-dependent. |
| EV-DATA-011: Processor roles, binding terms, authorisation of subprocessors and exit duties are governed by Article 28. |
SRC-001 SRC-014 |
Supported |
Contracts have not been reviewed. |
| EV-DATA-012: Joint controllers must allocate duties transparently and make the essence of their arrangement available. |
SRC-015 |
Supported |
Joint controllership cannot be inferred from data sharing alone. |
| EV-DATA-013: DPIAs are required for likely high-risk processing, including large-scale special-category processing. |
SRC-018 |
Supported |
No actual scale, risk or DPIA assessed. |
| EV-DATA-014: DPO duties depend on public-authority status or specified core-activity triggers. |
SRC-017 |
Supported |
Not a universal requirement for every health-data holder. |
| EV-DATA-015: Processing-record duties remain relevant to special-category processing even below 250 staff. |
SRC-016 |
Supported |
Record content and other exceptions require the statutory context. |
| EV-DATA-016: Security must be appropriate to risk and cover confidentiality, integrity, availability, resilience, recovery and testing. |
SRC-019 |
Supported |
Listed implementation controls are practical interpretation, not universal statutory product specifications. |
| EV-DATA-017: Retention is purpose-based; Article 5 does not set a universal health-data period. |
SRC-005 |
Supported |
Sector duties and actual record types remain to be assessed. |
| EV-DATA-018: Processors notify breaches without undue delay; controllers apply distinct regulator and individual notification thresholds. |
SRC-020 SRC-021 |
Supported |
An actual breach assessment is not provided. |
| EV-DATA-019: Restricted transfers need a recognised legal route; appropriate-safeguard transfers must meet the revised data-protection test. |
SRC-022 SRC-025 |
Supported |
No country adequacy determination or service transfer assessment made. |
| EV-DATA-020: The practical data map should include support copies, metadata, derived data, access and exit arrangements. |
SRC-001 SRC-005 SRC-014 SRC-016 SRC-019 |
synthesis |
Suggested implementation of statutory duties; not a mandated universal form. |
| EV-DATA-021: The official GOV.UK DUAA collection is included as the user-requested research entry point. |
SRC-077 |
Supported |
Specific legal conclusions rely on operative law and commencement evidence. |
| EV-DATA-022: EU GDPR can apply separately through establishment, targeted-service or behavioural-monitoring links under Article 3. |
SRC-078 |
conditional |
No actual EU nexus assessed; only conditional territorial reach is covered. |
| EV-DATA-023: Current UK GDPR Article 8A governs purpose compatibility; compatibility alone does not establish lawfulness. |
SRC-001 SRC-005 |
Supported |
Any further-use purpose needs a fact-specific assessment. |
| EV-DATA-024: DUAA amends rather than replaces UK GDPR and DPA 2018; its individual provisions have distinct commencement dates. |
SRC-006 SRC-007 SRC-008 SRC-077 |
Supported |
No assertion that all provisions across the Act commenced on one date. |
| NHS-E01: The current section 250 framework requires information standards to specify their addressees and includes relevant IT providers. |
SRC-046 SRC-049 |
Supported |
Does not prove any particular standard applies to an unspecified service. |
| NHS-E02: Health and Care Act 2022 section 95 commenced on 7 July 2025, with a saving for standards already published and in effect before that date. |
SRC-047 |
Supported |
Pre-existing standards need transitional analysis; do not automatically apply the new compliance wording. |
| NHS-E03: DUAA 2025 section 121 and Schedule 15 commenced on 5 February 2026. |
SRC-048 SRC-049 |
Supported |
Commencement of powers does not establish that every contemplated requirement has been imposed. |
| NHS-E04: DCB0129 and DCB0160 distinguish development/manufacture responsibilities from deployment/use responsibilities; official pages list June 2018 releases. |
SRC-050 SRC-051 |
Supported |
Actual roles, current notices, contracts and transition determine applicability. |
| NHS-E05: NHS detailed DCB applicability guidance excludes population-level statistical products from its direct-care scope but recommends adoption. |
SRC-052 SRC-047 |
Qualified |
Guidance dates from 2022 and quotes earlier legislation; a claimed secondary-use label does not settle actual care impact. |
| NHS-E06: NHS DCB background guidance describes manufacturer assurance through DCB0160 procurement requirements and contracts. |
SRC-053 |
Qualified |
The source predates later statutory amendments and is not a complete current-law statement. |
| NHS-E07: DTAC can cover population-health and service-management software, while excluding general-purpose HR/finance software merely used in healthcare. |
SRC-054 |
Supported |
Product purpose and actual use remain material. |
| NHS-E08: The revised DTAC form was introduced in February 2026 and the previous form should not be used from 6 April 2026. |
SRC-054 |
Supported |
Recheck the current form at procurement or reassessment. |
| NHS-E09: DTAC complements device regulation, DSPT and other assurance rather than replacing them. |
SRC-055 |
Supported |
A completed form does not establish compliance of every deployment. |
| NHS-E10: DSPT policy and contractual routes extend to NHS patient information processed for purposes beyond individual care. |
SRC-056 |
Supported |
Identify organisational category, actual NHS access and the applicable contract or access condition. |
| NHS-E11: The DSPT site displayed 2026–27 version 9 at the research check date. |
SRC-057 |
Supported |
The service is dynamic and requirements differ by organisation category. |
| NHS-E12: The NHS Records Management Code includes secondary-use records and is not a universal statutory retention schedule for all companies. |
SRC-058 |
Supported |
Actual organisation and record scope must be established. |
| NHS-E13: End of a minimum retention period requires appraisal; continuing need and legal, inquiry or access-request holds can affect disposal. |
SRC-059 |
Supported |
Select the relevant record schedule; no universal retention period is asserted. |
| NHS-E14: NHS guidance permits appropriately controlled public-cloud use and does not establish a universal UK-only storage requirement. |
SRC-060 |
Qualified |
May 2022 guidance must be combined with current transfer law, remote access and the actual contract. |
| NHS-E15: Medical-device software qualification depends on intended medical function; simple unchanged storage or administrative functionality is not sufficient by itself. |
SRC-063 |
Qualified |
Assess objective intended purpose, modules, claims and current UK MDR requirements. |
| NHS-E16: Additional GB medical-device post-market surveillance requirements apply within their scope from 16 June 2025. |
SRC-064 |
Supported |
Applies to qualifying devices placed on market or put into service from that date. |
| NHS-E17: AMRA applies to defined employment or insurance reports by a practitioner responsible for the individual's clinical care, with specified consent and access procedures. |
SRC-066 |
Supported |
It is not a general authority for all health-record transfers or all occupational-health processing. |
| NHS-E18: Employment power imbalance may prevent valid data-protection consent; collection of worker health information must be limited to need. |
SRC-067 |
Supported |
AMRA consent, confidentiality permission and UK GDPR conditions are separate assessments. |
| NHS-E19: Reasonable-adjustment duties and additional public-sector website/app accessibility rules may apply to the service interface. |
SRC-065 |
Supported |
This research does not resolve all employment discrimination or public-sector equality questions. |
| NHS-E20: PECR adds specific device-access and electronic-marketing rules, including amendments commenced on 5 February 2026. |
SRC-069 SRC-048 |
Supported |
Apply current exceptions and the actual activity; no blanket rule that every cookie needs consent is asserted. |
| NHS-E21: Children's code scope depends on a relevant online service being likely to be accessed by under-18s, not simply possession of children's records. |
SRC-068 |
Supported |
User population, service definition and parental or representative authority remain application-specific. |
| NHS-E22: Confidentiality can survive death; the appropriate access route and living third-party data must still be considered. |
SRC-070 |
Supported |
AHRA and other routes vary by requester and record; deceased information is not automatically freely reusable. |
| NHS-E23: NIS health-sector duties attach to designated operators of essential services rather than automatically to every health-data supplier. |
SRC-061 |
Supported |
Digital-service-provider scope and supply-chain contracts need separate review where relevant. |
| NHS-E24: The Cyber Security and Resilience Bill had not become operative law at the check date; Lords report stage was listed for 26 October 2026. |
SRC-062 |
Supported |
Date-sensitive parliamentary status as at 19 October 2026. |
| NHS-E25: An AI label does not determine device or clinical-safety applicability; intended use and care effects require separate assessment. |
SRC-063 SRC-052 |
Synthesis |
Synthesis of functional scope tests; automated-decision law is addressed separately in legal-framework.md. |
| NHS-E26: DSPT requirements distinguish DHSC policy for NHS patient information from the NHS Standard Contract route. |
SRC-080 SRC-081 |
Supported |
A different commissioner does not establish an exemption; the exact statutory and contractual position remains unassessed. |
| NHS-E27: Require continuing DSPT assurance expressly in contracts receiving identifiable NHS-origin records for purposes beyond individual care. |
SRC-056 SRC-081 SRC-082 |
Synthesis |
Proposed procurement condition and oversight model, not an existing contract term or universal statutory rule. |
| NHS-E28: DSPT organisation type and parent coverage depend on the services, contracts and activities actually covered. |
SRC-082 |
Supported |
Current category, legal entities, assessment period and required audit must be confirmed for the service. |
| NHS-E29: DTAC identifies when DSPT applies; DSPT does not replace the entire product data-protection assessment. |
SRC-055 |
Qualified |
Do not infer universal DTAC applicability solely from NHS-origin data or a universal DSPT prerequisite solely from DTAC. |
| NHS-E30: Authority for a report does not replace recipient data-protection grounds or justify unrestricted whole-record collection. |
SRC-067 SRC-083 |
Supported |
Employment and similar reports need the relevant statutory and professional context; no actual disclosure approved. |
| NHS-E31: The DSPT information-standard page still lists version 8 while the operational service offers version 9. |
SRC-057 SRC-080 |
Supported |
Point-in-time observation; the applicable period and deadlines require confirmation. |
| NHS-E32: DSPT combines organisational security and information governance but covers only part of the applicable legal and regulatory duties. |
SRC-087 |
Supported |
CAF-specific structure varies by cohort; assessment is not permission for a processing purpose. |
| NHS-E33: The 2026–27 version 9 notice aligns requirements with CAF 4.0 and specifies a 30 June 2027 submission deadline. |
SRC-093 |
Supported |
Check category, required interim submissions and contractual milestones; a new cycle does not alone invalidate the previous period. |
| NHS-E34: The 2026–27 DSPT audit notice specifies different mandatory areas for CAF organisations and IT suppliers. |
SRC-094 |
Supported |
No universal independent-certification claim or identical audit duty for all categories. |
| NHS-E35: Public DSPT lookup supports organisation and assessment checks; underlying evidence and actual coverage need further verification. |
SRC-088 SRC-056 SRC-082 |
Supported |
No actual vendor checked; the due-diligence checklist is an implementation recommendation. |
| NHS-E36: Assess DSPT early for NHS information or systems, regardless of a private or non-NHS commissioning label. |
SRC-056 SRC-061 SRC-081 |
Synthesis |
Identify the actual policy, standard, regulatory status, contract and access conditions; no blanket statutory obligation inferred from a slogan. |
| SCOPE-E01: NHS England uses “purposes beyond individual care”; individual care is also called direct care and includes specified care-quality activities. |
SRC-084 SRC-085 |
Supported |
Terminology follows NHS guidance and the user’s correction to the canonical question; source definitions and quotations remain intact. |
| NHS-E37: The recommended commissioning decision for direct GP recruitment records is mandatory DSPT assurance in the governing service contract. |
SRC-056 SRC-081 SRC-014 SRC-019 |
Synthesis |
Proposed condition; no actual contract or contractor's statutory applicability has been reviewed. |
| NHS-E38: GC21.2 of the 2026/27 NHS Standard Contract requires annual published DSPT assessment and compliance with applicable mandatory requirements. |
SRC-096 |
Supported |
Applies through that contract; no automatic incorporation into a non-NHS commission is inferred. |
| NHS-E39: The NDG advised that MOD pre-employment fitness decisions did not meet GP Connect's direct-care purpose. |
SRC-095 |
Qualified |
Published 2024 advice about a specific proposed access route; not a general prohibition on consented reports or a DSPT ruling. |
| NHS-E40: DAPB0086's statutory route requires an eligible addressee and relevant standard; the version 8 notice postdates the July 2025 transition. |
SRC-046 SRC-047 SRC-080 |
Qualified |
Direct-care classification and statutory health-care/provider scope are distinct; actual entity and functions remain unassessed. |
| EV-DATA-025: Article 6(1)(b) concerns a contract with the data subject or requested pre-contract steps, not merely an inter-organisational procurement contract. |
SRC-004 |
Supported |
Necessity and the separate Article 9 condition still require assessment. |
| EV-DATA-026: Genuinely anonymous information falls outside UK GDPR, while anonymising personal data remains processing. |
SRC-097 |
Supported |
Anonymity depends on the actual information and context; other rules can still apply. |
| CONF-E10: The national data opt-out does not apply to the specific use or disclosure to which a fully informed patient explicitly consents. |
SRC-031 |
Supported |
Does not cover unrelated reuse or remove data-protection and assurance duties. |
| EV-CONF-001: Confidentiality and data protection are cumulative requirements. |
SRC-026 SRC-027 SRC-030 |
Supported |
No actual disclosure route has been selected. |
| EV-CONF-002: CPI statutory definition uses confidential circumstances and contextual identifiability. |
SRC-026 SRC-029 |
Supported |
It is not interchangeable with all UK GDPR health data. |
| EV-CONF-003: CAG support is bounded and does not compel the source controller to disclose. |
SRC-027 SRC-030 |
Supported |
Read actual conditions and source permission. |
| EV-CONF-004: COPI regulation 7 limits purpose, access, identifiers and requires review at intervals no greater than 12 months. |
SRC-028 |
Supported |
Applies to processing within the Regulations. |
| EV-CONF-005: National data opt-out has defined scope and exceptions, including relevant internal repurposing. |
SRC-031 SRC-032 |
Supported |
Not a legal basis, consent or blanket veto on all uses. |
| EV-CONF-006: Caldicott principles guide governance; Guardian statutory guidance has defined organisational scope. |
SRC-034 SRC-035 SRC-036 |
Supported |
Not every software supplier is within the appointment-guidance duty. |
| EV-CONF-007: Participation consent, confidentiality consent and GDPR consent are distinct. |
SRC-041 SRC-030 |
Supported |
Each actual process needs the right permissions. |
| EV-CONF-008: Research, ethics, confidentiality and source access permissions must be considered separately. |
SRC-038 SRC-039 SRC-040 |
Supported |
No universal requirement or exemption is inferred. |
| EV-CONF-009: Secondary purpose is not determined by server location or outsourcing alone. |
SRC-037 |
Supported |
Classify each purpose and lifecycle phase. |
| EV-CONF-010: Secure data environment policies govern relevant NHS analysis/research access. |
SRC-071 SRC-072 |
Supported |
Policy and access terms do not supply missing legal grounds. |
| EV-CONF-011: Public authorities must consider Human Rights Act duties and Article 8 privacy. |
SRC-076 SRC-079 |
Supported |
Public-function status and exceptions require factual review. |
| EV-CONF-012: Pre-offer health enquiries face statutory restrictions and exceptions. |
SRC-074 |
Supported |
The stage and purpose of recruitment matter. |
| EV-CONF-013: Certain contractual demands for health records obtained through subject access are void. |
SRC-075 |
Supported |
Apply the exact section185 definition. |
| EV-CONF-014: The seed is a starting map, not proof of legal applicability. |
SRC-090 |
Supported |
No specific organisation or service is assumed. |
| REQ-E01: A requester's recipient duties exist without express disclosure conditions. |
SRC-005 SRC-019 SRC-103 |
Supported |
Actual duties follow roles, purposes and any applicable legal exceptions. |
| REQ-E02: The sender should check recipient security while the recipient assumes its own responsibilities. |
SRC-098 |
Supported |
Proportionate assurance; no unlimited sender liability or general separate-controller audit right inferred. |
| REQ-E03: Legal powers and implied confidentiality must be assessed separately from the UK GDPR basis. |
SRC-102 SRC-076 SRC-079 |
Supported |
Public-function scope and actual legal authority remain service-specific. |
| REQ-E04: Processor terms, joint-controller arrangements and separate-controller sharing agreements have different triggers. |
SRC-014 SRC-015 SRC-099 SRC-106 |
Supported |
No universal Article 28 agreement between a GP and every report recipient. |
| REQ-E05: The stated medical recruitment flow engages the DPIA trigger for opportunity decisions involving special-category data. |
SRC-018 SRC-100 |
Synthesis |
Reasoned application to supplied facts, not an ICO service ruling; actual assessment and any claimed legal exception remain unreviewed. |
| REQ-E06: The controller retains DPIA responsibility; a programme or integrated assessment can satisfy the duty if it covers the processing. |
SRC-018 SRC-101 |
Supported |
A document title, supplier assessment or security certificate alone is insufficient. |
| REQ-E07: A requester should offer proportionate assessment evidence; the full DPIA is not automatically owed to every source provider. |
SRC-018 SRC-098 SRC-101 |
Qualified |
No general sender-access right identified; actual contractual rights and lawful disclosure powers must be checked. |
| REQ-E08: An appropriate policy document is required by specified Schedule 1 conditions and is distinct from a DPIA. |
SRC-002 |
Supported |
Assess the selected Article 9 route and exact Schedule 1 condition. |
| REQ-E09: A structured requester evidence pack supports a governed provider disclosure decision. |
SRC-098 SRC-099 SRC-103 |
Synthesis |
Recommended implementation, not a universally prescribed form or blanket refusal rule. |