An operating model for a software service
Turn the applicable duties into a reviewable record for every purpose. This chapter is a recommended implementation method. The legal duties behind it are in the legal framework, data lifecycle, confidentiality and NHS standards.
For NHS patient information or system access, turn the DSPT assessment into a recorded requirement. Separate existing obligations from new contract conditions. For direct receipt of identifiable GP recruitment records, use the worked decision and make the recommended DSPT condition explicit. Use the verification checklist before onboarding and maintain assurance through renewal, changes and exit.
Before the requester asks for records
The requester receives the information; the GP practice or other provider receives the request and sends the information. Use requester readiness to prepare evidence before asking. This is the recommended sequence. A mandatory DPIA must be completed before the processing it covers starts. The requester must govern its processing even where the provider states no express conditions. SRC-018, SRC-098, SRC-103
Identify the responsible controller, implement safeguards and put the required role-specific agreements in place. Name who maintains the requester's evidence, who decides processing can start, and who verifies contractual conditions. The provider makes its own disclosure decision. Retain these decisions separately, with their scope and conditions.
The minimum decision record
| Decision | What the record should say | Responsible role to establish |
|---|---|---|
| Purpose and necessity | Intended outcome, population, required fields, rejected less intrusive alternatives | Controller’s accountable business owner |
| Roles and data flows | Source, destination, administrator access, subprocessor, region, onward disclosure and output | Controller with each supplier |
| Authority | Article 6 basis; Article 9 condition; DPA safeguards; confidentiality gateway; source permission | Controller, with appropriate IG/legal advice |
| Risk and safeguards | DPIA trigger and outcome; security; re-identification, discrimination and misuse risks | Controller and relevant risk/security owners |
| Requester readiness | Evidence-pack version, completed safeguards, unresolved actions, processing decision and provider disclosure conditions | Requester's named contact and responsible controller; provider owns its disclosure decision |
| Contracts and approvals | Processor or sharing arrangements, NHS access terms, research conditions and product duties | Relevant parties, sponsor or regulated manufacturer |
| NHS data assurance | Applicable DSPT route, assessment period, covered entities, status, audit evidence and contractual milestones; use the recommended condition | Purchaser with the source controller and supplier |
| Individual choices | Notices, consent where used, opt-outs, objections, rights requests and complaints | Controller; processors assist under their instructions |
| Retention and exit | Retention rationale, backup treatment, export, deletion evidence, holds and termination | Controller and processor |
| Change and incident control | Trigger for reassessment, incident escalation, reporting responsibility and approval expiry | Named service and governance owners |
These are suggested evidence artefacts. A document called a “data sharing agreement” is not a universal statutory prerequisite for every transfer; Article 28 processor terms have their own legal requirements. DPIA and DPO duties have defined triggers; the stated recruitment flow engages a DPIA trigger. See supplier and lifecycle duties.
Record and enforce the DSPT condition
For the proposed GP-record condition, record the purchaser's decision, binding clause, covered entities, assessment evidence and acceptance owner. Use the authority table to identify any parallel statutory or access duty.
Confirm the required period and acceptable status before data receipt. Record renewal dates, evidence access, incident notification, remediation and proportionate suspension arrangements. A supplier's promise to submit later is not the same as satisfying a pre-receipt condition. Any proposed exception needs an express purchaser decision; it cannot waive another party's rights or an applicable legal duty.
This is a recommended contract-management process. Keep it alongside the separate lawfulness and disclosure decisions; completing one record does not approve the whole service.
Apply the analysis to the entire service
Map production records, test datasets, backups, support tickets, telemetry, audit logs, exports, derived scores and model-training inputs. Avoid declaring an entire product compliant while leaving a secondary processing purpose unassessed. HRA’s development lifecycle illustrates why proof of concept, testing, care deployment and evaluation need separate consideration. SRC-037
Keep clinical data out of support channels and development tools unless their use is authorised and controlled. Prefer the least identifiable information sufficient for the task. When NHS research access is offered through a secure data environment, follow its access and output controls. An environment constrains use; it does not itself supply legal permission. SRC-071 SRC-072
A sensible decision gate
Record one of: authorised within stated conditions, changes required, not permitted on the proposed basis, or insufficient information. Explain the reason, evidence reviewed and decision owner. Identify the decision being made: processing, contractual acceptance or disclosure. An approval in one category does not decide the others. Avoid using “GDPR compliant” as an undifferentiated badge.
Reassess when purpose, data, recipients, support locations, model use, clinical function or governing law changes. Track approval conditions, review dates, action owners and evidence that required changes were completed. Keep access, rights, incident and retention controls operating after receipt; annual DSPT renewal is one part of that work. This change record should link back to the applicability map and evidence matrix. SRC-099, SRC-103