<!-- Derived Markdown alternate of evidence-matrix.md; canonical repository sources and registered evidence retain authority. -->


# Evidence matrix

**Supported** means an inspected authority supports the bounded statement. **Qualified** preserves a material scope or currency limitation. **Synthesis** identifies the research interpretation. None is an approval for a particular software service. The linked chapter contains the reasoning; each source identity links to its exact register row.

| Claim | Support | State | Limitation |
|---|---|---|---|
| EV-DATA-001: [UK GDPR scope follows processing and territorial links; purposes beyond individual care are not exempt.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) | Supported | No specific service data flow assessed. |
| EV-DATA-002: [Health-data processing requires Article 6 and Article 9 justification plus applicable DPA safeguards.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002) [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) | Supported | No lawful basis or condition selected for an actual purpose. |
| EV-DATA-003: [Article 9(2)(h) can cover occupational medicine and health-system management with the required safeguards.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002) [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | Supported | Not every commercial health-data purpose qualifies. |
| EV-DATA-004: [Pseudonymised data remains personal data for parties able to identify people; recipient anonymity is contextual.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-023](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-023) | Supported | Anonymity of any actual dataset has not been tested. |
| EV-DATA-005: [Inferred health status and revealing service metadata can be special-category data.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-024](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-024) | Supported | Not every generic appointment or technical event is health data. |
| EV-DATA-006: [Relevant DUAA reforms commenced 5 February 2026 and complaints provisions 19 June 2026.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) | Supported | Earlier activities may engage transitional and saving provisions. |
| EV-DATA-007: [Regulator functions transferred to the Information Commission on 30 September 2026.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-008](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-008) | Supported | Website branding remains ICO. |
| EV-DATA-008: [Current UK GDPR contains recognised legitimate interests in Article 6(1)(ea).](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) | Supported | Restricted to Annex 1 and not an Article 9 condition. |
| EV-DATA-009: [Research safeguards now sit in Articles 84A–D, including necessity, minimisation and individual-decision restrictions.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002) [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) [SRC-009](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-009) [SRC-010](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-010) | Supported | Actual research status, public interest and approvals remain unresolved. |
| EV-DATA-010: [Articles 22A–D replace old Article 22; significant solely automated special-category decisions retain strict restrictions.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-011](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-011) [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012) [SRC-013](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-013) | Supported | Actual significance and meaningful human involvement are fact-dependent. |
| EV-DATA-011: [Processor roles, binding terms, authorisation of subprocessors and exit duties are governed by Article 28.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) | Supported | Contracts have not been reviewed. |
| EV-DATA-012: [Joint controllers must allocate duties transparently and make the essence of their arrangement available.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-015](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-015) | Supported | Joint controllership cannot be inferred from data sharing alone. |
| EV-DATA-013: [DPIAs are required for likely high-risk processing, including large-scale special-category processing.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018) | Supported | No actual scale, risk or DPIA assessed. |
| EV-DATA-014: [DPO duties depend on public-authority status or specified core-activity triggers.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-017](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-017) | Supported | Not a universal requirement for every health-data holder. |
| EV-DATA-015: [Processing-record duties remain relevant to special-category processing even below 250 staff.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-016](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-016) | Supported | Record content and other exceptions require the statutory context. |
| EV-DATA-016: [Security must be appropriate to risk and cover confidentiality, integrity, availability, resilience, recovery and testing.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) | Supported | Listed implementation controls are practical interpretation, not universal statutory product specifications. |
| EV-DATA-017: [Retention is purpose-based; Article 5 does not set a universal health-data period.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) | Supported | Sector duties and actual record types remain to be assessed. |
| EV-DATA-018: [Processors notify breaches without undue delay; controllers apply distinct regulator and individual notification thresholds.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-020](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-020) [SRC-021](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-021) | Supported | An actual breach assessment is not provided. |
| EV-DATA-019: [Restricted transfers need a recognised legal route; appropriate-safeguard transfers must meet the revised data-protection test.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-022](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-022) [SRC-025](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-025) | Supported | No country adequacy determination or service transfer assessment made. |
| EV-DATA-020: [The practical data map should include support copies, metadata, derived data, access and exit arrangements.](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) | [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) [SRC-016](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-016) [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) | synthesis | Suggested implementation of statutory duties; not a mandated universal form. |
| EV-DATA-021: [The official GOV.UK DUAA collection is included as the user-requested research entry point.](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) | [SRC-077](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-077) | Supported | Specific legal conclusions rely on operative law and commencement evidence. |
| EV-DATA-022: [EU GDPR can apply separately through establishment, targeted-service or behavioural-monitoring links under Article 3.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-078](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-078) | conditional | No actual EU nexus assessed; only conditional territorial reach is covered. |
| EV-DATA-023: [Current UK GDPR Article 8A governs purpose compatibility; compatibility alone does not establish lawfulness.](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) | [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) | Supported | Any further-use purpose needs a fact-specific assessment. |
| EV-DATA-024: [DUAA amends rather than replaces UK GDPR and DPA 2018; its individual provisions have distinct commencement dates.](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) | [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) [SRC-008](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-008) [SRC-077](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-077) | Supported | No assertion that all provisions across the Act commenced on one date. |
| NHS-E01: [The current section 250 framework requires information standards to specify their addressees and includes relevant IT providers.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046) [SRC-049](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-049) | Supported | Does not prove any particular standard applies to an unspecified service. |
| NHS-E02: [Health and Care Act 2022 section 95 commenced on 7 July 2025, with a saving for standards already published and in effect before that date.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047) | Supported | Pre-existing standards need transitional analysis; do not automatically apply the new compliance wording. |
| NHS-E03: [DUAA 2025 section 121 and Schedule 15 commenced on 5 February 2026.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-048](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-048) [SRC-049](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-049) | Supported | Commencement of powers does not establish that every contemplated requirement has been imposed. |
| NHS-E04: [DCB0129 and DCB0160 distinguish development/manufacture responsibilities from deployment/use responsibilities; official pages list June 2018 releases.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-050](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-050) [SRC-051](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-051) | Supported | Actual roles, current notices, contracts and transition determine applicability. |
| NHS-E05: [NHS detailed DCB applicability guidance excludes population-level statistical products from its direct-care scope but recommends adoption.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052) [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047) | Qualified | Guidance dates from 2022 and quotes earlier legislation; a claimed secondary-use label does not settle actual care impact. |
| NHS-E06: [NHS DCB background guidance describes manufacturer assurance through DCB0160 procurement requirements and contracts.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-053](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-053) | Qualified | The source predates later statutory amendments and is not a complete current-law statement. |
| NHS-E07: [DTAC can cover population-health and service-management software, while excluding general-purpose HR/finance software merely used in healthcare.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054) | Supported | Product purpose and actual use remain material. |
| NHS-E08: [The revised DTAC form was introduced in February 2026 and the previous form should not be used from 6 April 2026.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054) | Supported | Recheck the current form at procurement or reassessment. |
| NHS-E09: [DTAC complements device regulation, DSPT and other assurance rather than replacing them.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055) | Supported | A completed form does not establish compliance of every deployment. |
| NHS-E10: [DSPT policy and contractual routes extend to NHS patient information processed for purposes beyond individual care.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md) | [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) | Supported | Identify organisational category, actual NHS access and the applicable contract or access condition. |
| NHS-E11: [The DSPT site displayed 2026–27 version 9 at the research check date.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md) | [SRC-057](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-057) | Supported | The service is dynamic and requirements differ by organisation category. |
| NHS-E12: [The NHS Records Management Code includes secondary-use records and is not a universal statutory retention schedule for all companies.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-058](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-058) | Supported | Actual organisation and record scope must be established. |
| NHS-E13: [End of a minimum retention period requires appraisal; continuing need and legal, inquiry or access-request holds can affect disposal.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-059](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-059) | Supported | Select the relevant record schedule; no universal retention period is asserted. |
| NHS-E14: [NHS guidance permits appropriately controlled public-cloud use and does not establish a universal UK-only storage requirement.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) | [SRC-060](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-060) | Qualified | May 2022 guidance must be combined with current transfer law, remote access and the actual contract. |
| NHS-E15: [Medical-device software qualification depends on intended medical function; simple unchanged storage or administrative functionality is not sufficient by itself.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-063](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-063) | Qualified | Assess objective intended purpose, modules, claims and current UK MDR requirements. |
| NHS-E16: [Additional GB medical-device post-market surveillance requirements apply within their scope from 16 June 2025.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-064](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-064) | Supported | Applies to qualifying devices placed on market or put into service from that date. |
| NHS-E17: [AMRA applies to defined employment or insurance reports by a practitioner responsible for the individual's clinical care, with specified consent and access procedures.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-066](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-066) | Supported | It is not a general authority for all health-record transfers or all occupational-health processing. |
| NHS-E18: [Employment power imbalance may prevent valid data-protection consent; collection of worker health information must be limited to need.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-067](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-067) | Supported | AMRA consent, confidentiality permission and UK GDPR conditions are separate assessments. |
| NHS-E19: [Reasonable-adjustment duties and additional public-sector website/app accessibility rules may apply to the service interface.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-065](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-065) | Supported | This research does not resolve all employment discrimination or public-sector equality questions. |
| NHS-E20: [PECR adds specific device-access and electronic-marketing rules, including amendments commenced on 5 February 2026.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-069](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-069) [SRC-048](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-048) | Supported | Apply current exceptions and the actual activity; no blanket rule that every cookie needs consent is asserted. |
| NHS-E21: [Children's code scope depends on a relevant online service being likely to be accessed by under-18s, not simply possession of children's records.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-068](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-068) | Supported | User population, service definition and parental or representative authority remain application-specific. |
| NHS-E22: [Confidentiality can survive death; the appropriate access route and living third-party data must still be considered.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-070](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-070) | Supported | AHRA and other routes vary by requester and record; deceased information is not automatically freely reusable. |
| NHS-E23: [NIS health-sector duties attach to designated operators of essential services rather than automatically to every health-data supplier.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-061](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-061) | Supported | Digital-service-provider scope and supply-chain contracts need separate review where relevant. |
| NHS-E24: [The Cyber Security and Resilience Bill had not become operative law at the check date; Lords report stage was listed for 26 October 2026.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-062](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-062) | Supported | Date-sensitive parliamentary status as at 19 October 2026. |
| NHS-E25: [An AI label does not determine device or clinical-safety applicability; intended use and care effects require separate assessment.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-063](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-063) [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052) | Synthesis | Synthesis of functional scope tests; automated-decision law is addressed separately in legal-framework.md. |
| NHS-E26: [DSPT requirements distinguish DHSC policy for NHS patient information from the NHS Standard Contract route.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#nhs-origin-records-outside-nhs-commissioning) | [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) | Supported | A different commissioner does not establish an exemption; the exact statutory and contractual position remains unassessed. |
| NHS-E27: [Require continuing DSPT assurance expressly in contracts receiving identifiable NHS-origin records for purposes beyond individual care.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition) | [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082) | Synthesis | Proposed procurement condition and oversight model, not an existing contract term or universal statutory rule. |
| NHS-E28: [DSPT organisation type and parent coverage depend on the services, contracts and activities actually covered.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition) | [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082) | Supported | Current category, legal entities, assessment period and required audit must be confirmed for the service. |
| NHS-E29: [DTAC identifies when DSPT applies; DSPT does not replace the entire product data-protection assessment.](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md#dtac-product-assessment) | [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055) | Qualified | Do not infer universal DTAC applicability solely from NHS-origin data or a universal DSPT prerequisite solely from DTAC. |
| NHS-E30: [Authority for a report does not replace recipient data-protection grounds or justify unrestricted whole-record collection.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#nhs-origin-records-outside-nhs-commissioning) | [SRC-067](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-067) [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083) | Supported | Employment and similar reports need the relevant statutory and professional context; no actual disclosure approved. |
| NHS-E31: [The DSPT information-standard page still lists version 8 while the operational service offers version 9.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#current-assessment-period) | [SRC-057](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-057) [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) | Supported | Point-in-time observation; the applicable period and deadlines require confirmation. |
| NHS-E32: [DSPT combines organisational security and information governance but covers only part of the applicable legal and regulatory duties.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#why-dspt-is-central-when-nhs-information-is-involved) | [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087) | Supported | CAF-specific structure varies by cohort; assessment is not permission for a processing purpose. |
| NHS-E33: [The 2026–27 version 9 notice aligns requirements with CAF 4.0 and specifies a 30 June 2027 submission deadline.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#current-assessment-period) | [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) | Supported | Check category, required interim submissions and contractual milestones; a new cycle does not alone invalidate the previous period. |
| NHS-E34: [The 2026–27 DSPT audit notice specifies different mandatory areas for CAF organisations and IT suppliers.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-the-annual-assessment-covers) | [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094) | Supported | No universal independent-certification claim or identical audit duty for all categories. |
| NHS-E35: [Public DSPT lookup supports organisation and assessment checks; underlying evidence and actual coverage need further verification.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#verify-a-published-dspt-claim) | [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088) [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082) | Supported | No actual vendor checked; the due-diligence checklist is an implementation recommendation. |
| NHS-E36: [The purchaser identifies DSPT conditions during supplier selection for NHS information or systems, regardless of a private or non-NHS commissioning label.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#requirements-before-contract-award-and-access) | [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) [SRC-061](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-061) [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) | Synthesis | Identify the actual policy, standard, regulatory status, contract and access conditions; no blanket statutory obligation inferred from a slogan. |
| SCOPE-E01: [NHS England uses “purposes beyond individual care”; individual care is also called direct care and includes specified care-quality activities.](https://healthcare-data-management-wiki.pages.dev/glossary/index.md) | [SRC-084](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-084) [SRC-085](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-085) | Supported | Terminology follows NHS guidance and the user’s correction to the canonical question; source definitions and quotations remain intact. |
| NHS-E37: [The recommended commissioning decision for direct GP recruitment records is mandatory DSPT assurance in the governing service contract.](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) | [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) | Synthesis | Proposed condition; no actual contract or contractor's statutory applicability has been reviewed. |
| NHS-E38: [GC21.2 of the 2026/27 NHS Standard Contract requires annual published DSPT assessment and compliance with applicable mandatory requirements.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-makes-dspt-mandatory) | [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096) | Supported | Applies through that contract; no automatic incorporation into a non-NHS commission is inferred. |
| NHS-E39: [The NDG advised that MOD pre-employment fitness decisions did not meet GP Connect's direct-care purpose.](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md#the-flow-being-assessed) | [SRC-095](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-095) | Qualified | Published 2024 advice about a specific proposed access route; not a general prohibition on consented reports or a DSPT ruling. |
| NHS-E40: [DAPB0086's statutory route requires an eligible addressee and relevant standard; the version 8 notice postdates the July 2025 transition.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-makes-dspt-mandatory) | [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046) [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047) [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) | Qualified | Direct-care classification and statutory health-care/provider scope are distinct; actual entity and functions remain unassessed. |
| EV-DATA-025: [Article 6(1)(b) concerns a contract with the data subject or requested pre-contract steps, not merely an inter-organisational procurement contract.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md#identify-a-lawful-route-for-each-purpose) | [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) | Supported | Necessity and the separate Article 9 condition still require assessment. |
| NHS-E41: [NHS supplier guidance places checks of the supplier's latest DSPT status before contract award.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#requirements-before-contract-award-and-access) | [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107) | Supported | A purchaser due-diligence check, not a universal fresh-assessment deadline before procurement begins. |
| NHS-E42: [NHS supplier guidance describes an equal-or-higher assurance route for its supplier check.](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition) | [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107) | Qualified | The route does not automatically satisfy an express DSPT contract or system-access condition; current category requirements remain relevant. |
| EV-DATA-026: [Genuinely anonymous information falls outside UK GDPR, while anonymising personal data remains processing.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md#classify-the-information-first) | [SRC-097](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-097) | Supported | Anonymity depends on the actual information and context; other rules can still apply. |
| CONF-E10: [The national data opt-out does not apply to the specific use or disclosure to which a fully informed patient explicitly consents.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md#national-data-opt-out) | [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031) | Supported | Does not cover unrelated reuse or remove data-protection and assurance duties. |
| EV-CONF-001: [Confidentiality and data protection are cumulative requirements.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030) | Supported | No actual disclosure route has been selected. |
| EV-CONF-002: [CPI statutory definition uses confidential circumstances and contextual identifiability.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026) [SRC-029](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-029) | Supported | It is not interchangeable with all UK GDPR health data. |
| EV-CONF-003: [CAG support is bounded and does not compel the source controller to disclose.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030) | Supported | Read actual conditions and source permission. |
| EV-CONF-004: [COPI regulation 7 limits purpose, access, identifiers and requires review at intervals no greater than 12 months.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-028](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-028) | Supported | Applies to processing within the Regulations. |
| EV-CONF-005: [National data opt-out has defined scope and exceptions, including relevant internal repurposing.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031) [SRC-032](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-032) | Supported | Not a legal basis, consent or blanket veto on all uses. |
| EV-CONF-006: [Caldicott principles guide governance; Guardian statutory guidance has defined organisational scope.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-034](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-034) [SRC-035](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-035) [SRC-036](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-036) | Supported | Not every software supplier is within the appointment-guidance duty. |
| EV-CONF-007: [Participation consent, confidentiality consent and GDPR consent are distinct.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-041](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-041) [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030) | Supported | Each actual process needs the right permissions. |
| EV-CONF-008: [Research, ethics, confidentiality and source access permissions must be considered separately.](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) | [SRC-038](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-038) [SRC-039](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-039) [SRC-040](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-040) | Supported | No universal requirement or exemption is inferred. |
| EV-CONF-009: [Secondary purpose is not determined by server location or outsourcing alone.](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) | [SRC-037](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-037) | Supported | Classify each purpose and lifecycle phase. |
| EV-CONF-010: [Secure data environment policies govern relevant NHS analysis/research access.](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) | [SRC-071](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-071) [SRC-072](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-072) | Supported | Policy and access terms do not supply missing legal grounds. |
| EV-CONF-011: [Public authorities must consider Human Rights Act duties and Article 8 privacy.](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) | [SRC-076](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-076) [SRC-079](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-079) | Supported | Public-function status and exceptions require factual review. |
| EV-CONF-012: [Pre-offer health enquiries face statutory restrictions and exceptions.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-074](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-074) | Supported | The stage and purpose of recruitment matter. |
| EV-CONF-013: [Certain contractual demands for health records obtained through subject access are void.](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md) | [SRC-075](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-075) | Supported | Apply the exact section185 definition. |
| EV-CONF-014: [The seed is a starting map, not proof of legal applicability.](https://healthcare-data-management-wiki.pages.dev/seed-review/index.md) | [SRC-090](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-090) | Supported | No specific organisation or service is assumed. |
| REQ-E01: [A requester's recipient duties exist without express disclosure conditions.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103) | Supported | Actual duties follow roles, purposes and any applicable legal exceptions. |
| REQ-E02: [The sender should check recipient security while the recipient assumes its own responsibilities.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098) | Supported | Proportionate assurance; no unlimited sender liability or general separate-controller audit right inferred. |
| REQ-E03: [Legal powers and implied confidentiality must be assessed separately from the UK GDPR basis.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-102](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-102) [SRC-076](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-076) [SRC-079](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-079) | Supported | Public-function scope and actual legal authority remain service-specific. |
| REQ-E04: [Processor terms, joint-controller arrangements and separate-controller sharing agreements have different triggers.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) [SRC-015](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-015) [SRC-099](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-099) [SRC-106](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-106) | Supported | No universal Article 28 agreement between a GP and every report recipient. |
| REQ-E05: [The stated medical recruitment flow engages the DPIA trigger for opportunity decisions involving special-category data.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018) [SRC-100](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-100) | Synthesis | Reasoned application to supplied facts, not an ICO service ruling; actual assessment and any claimed legal exception remain unreviewed. |
| REQ-E06: [The controller retains DPIA responsibility; a programme or integrated assessment can satisfy the duty if it covers the processing.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018) [SRC-101](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-101) | Supported | A document title, supplier assessment or security certificate alone is insufficient. |
| REQ-E07: [A requester should offer proportionate assessment evidence; the full DPIA is not automatically owed to every source provider.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018) [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098) [SRC-101](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-101) | Qualified | No general sender-access right identified; actual contractual rights and lawful disclosure powers must be checked. |
| REQ-E08: [An appropriate policy document is required by specified Schedule 1 conditions and is distinct from a DPIA.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002) | Supported | Assess the selected Article 9 route and exact Schedule 1 condition. |
| REQ-E09: [A structured requester evidence pack supports a governed provider disclosure decision.](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) | [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098) [SRC-099](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-099) [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103) | Synthesis | Recommended implementation, not a universally prescribed form or blanket refusal rule. |

The requester-readiness claims also inform the [overview](https://healthcare-data-management-wiki.pages.dev/index.md), [question and answer](https://healthcare-data-management-wiki.pages.dev/exam-answer/index.md), [applicability map](https://healthcare-data-management-wiki.pages.dev/applicability/index.md), subject chapters and portable concepts. Those summaries retain the same evidence states and qualifications.

Unresolved application decisions are held in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md). The [research log](https://healthcare-data-management-wiki.pages.dev/log/index.md) records the scope and review process.