Glossary
| Term | Meaning in this wiki | Detail |
|---|---|---|
| Personal data | Information relating to an identified or identifiable living person | Legal framework |
| Health data | Personal data concerning physical or mental health, including information revealing health status | Legal framework |
| Special category data | The protected categories governed by UK GDPR Article 9, including health data | Legal framework |
| CPI | Confidential patient information under the s251 statutory definition | Confidentiality |
| Pseudonymisation | Reducing attribution by separating additional identifying information; not necessarily anonymity | Legal framework |
| Anonymous information | Information for which people are not identifiable under the applicable test | Legal framework |
| Individual care / direct care | Care and treatment of an individual; the NHS policy definition also includes specified local audit and care-quality activities involving the responsible team | SRC-085 · Applicability |
| Purposes beyond individual care | Preferred explanatory term here, following NHS England, for uses outside the individual's care and treatment | SRC-084 · Applicability |
| Secondary use / indirect care | Alternative terms used by sources; inspect the actual purpose and source definition rather than assuming every boundary is identical | SRC-084 · SRC-033 |
| Requester / recipient | The organisation asking for records or a report and receiving that information; for example, a recruitment service. This identifies direction, not its controller or processor role | Requester readiness |
| Provider / source provider | The GP practice or other healthcare provider that receives the request and sends the information. This describes the record-request flow, not a software supplier | Requester readiness |
| Controller | The party determining purposes and essential means of processing | Data lifecycle |
| Processor | A party processing personal data on a controller’s behalf | Data lifecycle |
| DPA 2018 | Data Protection Act 2018, legislation supplementing UK GDPR. Use the full name where “DPA” could mean an agreement | Legal framework |
| Data-processing agreement (also abbreviated DPA) | Binding terms for a controller's use of a processor under Article 28; another qualifying legal act can meet that requirement. It is distinct from the Data Protection Act and a DPIA | SRC-014 · Required documents |
| DSA | Data-sharing agreement: records how controllers share and handle information. Recommended for continuing separate-controller flows; not universally required for every disclosure | SRC-099 · Required documents |
| DSPA | Data sharing and processing agreement: NHS England's combined template for processing, sharing and joint-controller arrangements. Select the applicable terms; the template excludes research | SRC-106 · Required documents |
| APD | Appropriate policy document: the compliance, retention and erasure document required by specified DPA 2018 Schedule 1 conditions; not every Article 9 route | SRC-002 · Required documents |
| DPIA | Data protection impact assessment: the controller's assessment before processing that meets a mandatory trigger or is otherwise likely to result in high risk. The recruitment opportunity/special-category trigger does not depend on automation or large scale | SRC-018 · SRC-100 · Recruitment assessment |
| DPO | Data Protection Officer; a role with defined appointment triggers and independence requirements | Data lifecycle |
| DUAA | Data (Use and Access) Act 2025, which amends the UK data-protection framework and other legislation | DUAA |
| COPI | Health Service (Control of Patient Information) Regulations 2002 | Confidentiality |
| CAG | Confidentiality Advisory Group, which advises on defined non-consensual CPI uses | Confidentiality |
| NDOO | England’s national data opt-out; distinct from GDPR objection and consent | Confidentiality |
| DSPT | Data Security and Protection Toolkit: organisational assurance for relevant NHS information and systems, with annual and category-specific requirements | DSPT assessment |
| CAF | NCSC Cyber Assessment Framework; the DSPT applies a health and care overlay for its CAF cohorts | DSPT requirements |
| DTAC | Digital Technology Assessment Criteria | NHS standards |
| DCB0129 / DCB0160 | Clinical risk management standards for manufacture and deployment/use of Health IT respectively, within scope | NHS standards |
| SDE | Secure data environment: controlled access and analysis with governed outputs | Operating model |
| AMRA | Access to Medical Reports Act 1988 | Conditional regimes |
These are reading aids. Follow the linked chapter for legal definitions, source citations and exceptions.
Historical records and source quotations retain their wording. “Direct care” remains appropriate when identifying that category or an official source's terminology.