Exam question and answer

Question

What overarching rules, laws and regulations apply to digitally storing and processing healthcare data through software services for purposes beyond individual care in England?

Short answer

Apply UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, alongside the common-law duty of confidentiality. Processing for purposes beyond individual care is not an exemption. Additional duties depend on the purpose, organisation, data source and software's function. SRC-001, SRC-002, SRC-006, SRC-033

Where NHS patient information or NHS-system access is involved, establish and maintain DSPT assurance as well. DSPT does not replace lawful processing grounds or disclosure authority. Distinguish legal duties, applicable standards, contractual requirements and assurance. SRC-056, SRC-081, SRC-087

What does “purposes beyond individual care” mean?

It describes the purpose of using the information, not the computer's location. External hosting can support individual care. Research inside a hospital can serve a different purpose. Storage is itself processing. This wiki follows NHS England's terminology. SRC-084, SRC-001, SRC-037

What permits the processing and disclosure?

Establish data-protection grounds and confidentiality authority separately.

• Data protection: personal health data is special-category data. Establish an Article 6 lawful basis, an Article 9 condition and applicable DPA safeguards. Research, public health, occupational medicine and health-system management have conditional routes. None permits every secondary commercial use. Pseudonymisation does not automatically make data anonymous. SRC-003, SRC-004, SRC-002, SRC-023
• Confidentiality: consent or another lawful gateway must cover the disclosure and use of confidential patient information. Implied direct-care consent does not generally authorise unrelated secondary purposes. Section 251 and the COPI Regulations can support defined uses without consent, subject to approval and safeguards. They neither replace UK GDPR nor compel disclosure. Assess England's national data opt-out and applicable approval conditions. SRC-026, SRC-027, SRC-030, SRC-031

Read the legal framework and confidentiality assessment together.

What must a requester have in place?

The requester must govern its own receipt and use of identifiable records or reports. The provider receives the request and sends the information. Its permission does not discharge the recipient's duties. Identify the controller, lawful grounds, safeguards and required agreements; do not assume the recipient is the provider's processor. SRC-014, SRC-098, SRC-103

Complete a DPIA before processing where required. The stated recruitment flow engages the published opportunity/special-category trigger, subject to an applicable legal exception. That is a reasoned application to the example, not a rule that every health-data request requires a new DPIA. The requester chapter explains the assessment, agreement types, appropriate policy documents and evidence to provide. SRC-018, SRC-100

When does DSPT apply, and should it be contractual?

NHS policy extends DSPT assurance to NHS patient information used for any purpose. A different commissioner or a purpose beyond individual care does not itself remove that expectation. Establish the applicable requirement, verify current organisational assurance and maintain it throughout the service. SRC-056, SRC-081

For a commissioned service receiving identifiable records directly from NHS GPs, the recommendation is mandatory DSPT assurance in the contract. Identify any existing statutory or contractual duty separately. UK GDPR imposes security and accountability duties, but does not itself prescribe DSPT. SRC-014, SRC-019, SRC-080

The DSPT chapter explains the basis and evidence. The worked recruitment example shows how to apply the recommendation without claiming that an unreviewed contract already requires it.

What duties continue throughout the service?

Assign responsibility and maintain controls from collection to deletion. Determine controller and processor roles from actual decisions. Where a controller uses a processor, put the required terms and subprocessor controls in place. SRC-014

Apply fairness, transparency, minimisation, accuracy, justified retention, security and individual rights. Control access, onward use, international transfers, incidents and deletion. A data protection impact assessment (DPIA) and a data protection officer (DPO) are required where their legal triggers apply. SRC-005, SRC-017, SRC-018, SRC-019

There is no universal UK-only hosting rule or single retention period for all health data. Use the data lifecycle assessment to establish the actual requirements. SRC-005, SRC-025

Which additional requirements may apply?

Apply each requirement only when its scope is met.

What difference does DUAA 2025 make?

DUAA amends the continuing UK framework; it does not replace UK GDPR. Relevant reforms commenced in 2026, including revised research safeguards and automated-decision rules. Use current provisions and applicable transitional rules. Read DUAA changes before relying on older summaries. SRC-006, SRC-007, SRC-009, SRC-010, SRC-012, SRC-047

How do I apply this answer to a real service?

Use the applicability map to identify the duties, then the operating model to record the decisions and evidence. For incoming records or reports, prepare the requester evidence for the sending provider. Establish the purpose, data, roles, legal authority, assurance requirements and lifecycle controls for each flow.

Sources were checked on 19 October 2026. This answer does not approve an individual service; unresolved application questions remain in the validation queue.