<!-- Derived Markdown alternate of exam-answer.md; canonical repository sources and registered evidence retain authority. -->


# Exam question and answer

## Question

<blockquote class="governing-question">
<p>What overarching rules, laws and regulations apply to digitally storing and processing healthcare data through software services for purposes beyond individual care in England?</p>
</blockquote>

## Short answer

**Apply UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, alongside the common-law duty of confidentiality.** Processing for purposes beyond individual care is not an exemption. Additional duties depend on the purpose, organisation, data source and software's function. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006), [SRC-033](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-033)

**Under NHS policy, organisations processing NHS patient information must provide annual assurance through the Data Security and Protection Toolkit (DSPT).** This includes processing for purposes beyond individual care. NHS-system access also carries system-specific assurance conditions. DSPT assurance does not provide lawful processing grounds or disclosure authority. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-087](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-087)

## What does “purposes beyond individual care” mean?

**It describes the purpose of using the information, not the computer's location.** External hosting can support individual care. Research inside a hospital can serve a different purpose. Storage is itself processing. This wiki follows NHS England's terminology. [SRC-084](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-084), [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-037](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-037)

## What permits the processing and disclosure?

**Establish data-protection grounds and confidentiality authority separately.**

- **Data protection:** personal health data is special-category data. Establish an Article 6 lawful basis, an Article 9 condition and applicable DPA safeguards. Research, public health, occupational medicine and health-system management have conditional routes. None permits every secondary commercial use. Pseudonymisation does not automatically make data anonymous. [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-023](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-023)
- **Confidentiality:** consent or another lawful gateway must cover the disclosure and use of confidential patient information. Implied direct-care consent does not generally authorise unrelated secondary purposes. Section 251 and the COPI Regulations can support defined uses without consent, subject to approval and safeguards. They neither replace UK GDPR nor compel disclosure. Assess England's national data opt-out and applicable approval conditions. [SRC-026](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-026), [SRC-027](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-027), [SRC-030](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-030), [SRC-031](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-031)

Read the [legal framework](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md) and [confidentiality assessment](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) together.

## What must a requester have in place?

**The requester must govern its own receipt and use of identifiable records or reports.** The provider receives the request and sends the information. Its permission does not discharge the recipient's duties. Identify the controller, lawful grounds, safeguards and required agreements; do not assume the recipient is the provider's processor. [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

Complete a DPIA before processing where required. The stated recruitment flow engages the published opportunity/special-category trigger, subject to an applicable legal exception. That is a reasoned application to the example, not a rule that every health-data request requires a new DPIA. The [requester chapter](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md) explains the assessment, agreement types, appropriate policy documents and evidence to provide. [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018), [SRC-100](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-100)

## When does DSPT apply, and should it be contractual?

**DHSC policy covers organisations processing NHS patient information for any purpose.** The receiving organisation completes and publishes its DSPT assessment. A non-NHS commissioner or a purpose beyond individual care does not remove this policy requirement. Where the NHS Standard Contract governs the service, GC21.2 requires annual publication and compliance with the applicable mandatory DSPT requirements. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096)

NHS England's supplier guidance places the NHS purchaser's check of the supplier's latest annual DSPT status **before contract award**. The purchaser also needs evidence that the assessment covers the supplier's legal entity and contracted service, with any applicable audit. [SRC-107](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-107), [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094)

For a service receiving identifiable records directly from NHS GPs, the commissioning organisation should make DSPT an explicit contract condition. Under the [recommended condition](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition), the contractor must have acceptable published status before receiving records and maintain annual assurance afterwards. This recommendation is separate from any existing statutory or contractual duty. UK GDPR requires security and accountability, but does not itself prescribe DSPT. [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080)

The [DSPT chapter](https://healthcare-data-management-wiki.pages.dev/dspt/index.md) explains the basis and evidence. The [worked recruitment example](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) shows how to apply the recommendation without claiming that an unreviewed contract already requires it.

## What duties continue throughout the service?

**Assign responsibility and maintain controls from collection to deletion.** Determine controller and processor roles from actual decisions. Where a controller uses a processor, put the required terms and subprocessor controls in place. [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014)

Apply fairness, transparency, minimisation, accuracy, justified retention, security and individual rights. Control access, onward use, international transfers, incidents and deletion. A data protection impact assessment (DPIA) and a data protection officer (DPO) are required where their legal triggers apply. [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-017](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-017), [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019)

There is no universal UK-only hosting rule or single retention period for all health data. Use the [data lifecycle assessment](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) to establish the actual requirements. [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-025](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-025)

## Which additional requirements may apply?

**Apply each requirement only when its scope is met.**

| Area | What to establish |
|---|---|
| NHS standards and product assurance | Check applicable information standards, data-access terms and DTAC. DCB0129 and DCB0160 address defined clinical-safety responsibilities; storing health data alone does not activate them. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052), [SRC-054](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-054) |
| Medical-device regulation | Assess the software's intended medical purpose and function. [SRC-063](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-063) |
| Purpose-specific duties | Check research approvals, employment/insurance report rights, equality, children's services, electronic tracking and cyber regulation where relevant. See [conditional regimes](https://healthcare-data-management-wiki.pages.dev/conditional-regimes/index.md). [SRC-038](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-038), [SRC-066](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-066), [SRC-069](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-069) |
| Public-authority and health-information governance | Consider Human Rights Act and Article 8 privacy duties. Apply Caldicott principles and assess the defined scope of statutory Guardian guidance. These supplement the other tests. [SRC-076](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-076), [SRC-079](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-079), [SRC-034](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-034), [SRC-035](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-035) |

## What difference does DUAA 2025 make?

**DUAA amends the continuing UK framework; it does not replace UK GDPR.** Relevant reforms commenced in 2026, including revised research safeguards and automated-decision rules. Use current provisions and applicable transitional rules. Read [DUAA changes](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) before relying on older summaries. [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006), [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007), [SRC-009](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-009), [SRC-010](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-010), [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012), [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047)

## How do I apply this answer to a real service?

Use the [applicability map](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) to identify the duties, then the [operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) to record the decisions and evidence. For incoming records or reports, prepare the [requester evidence](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md#what-should-accompany-the-request) for the sending provider. Establish the purpose, data, roles, legal authority, assurance requirements and lifecycle controls for each flow.

Sources were checked on **19 October 2026**. This answer does not approve an individual service; unresolved application questions remain in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md).