Recruitment: NHS GP records
Yes: make DSPT a mandatory contract condition for a recruitment service that receives identifiable records or reports directly from NHS GPs. This is the wiki's commissioning recommendation. It follows the NHS-data assurance policy and gives the purchaser an explicit, enforceable requirement. Whether an existing statute or contract already requires DSPT is a separate question. SRC-056, SRC-081
The flow being assessed
A GP practice sends identifiable clinical information directly to a contracted service, with the individual's authority. The service uses it to assess medical eligibility for recruitment. The commissioner is outside NHS commissioning. This worked example examines that flow; it does not claim to have reviewed an actual contract, supplier assessment or dataset.
Medical judgement does not make every purpose individual care. In its 2023–24 report, the National Data Guardian considered MOD requests for GP Connect access for fitness-to-serve decisions. It classified that purpose as beyond direct care and did not support the proposed access. That published advice concerns GP Connect's purpose restriction. It does not prohibit every consented GP report. Nor does it decide DSPT applicability. SRC-095
What the requester must have ready
The recruitment service is the requester and recipient of information. The GP practice or other healthcare provider is the recipient of the request and sender of information. The requester must govern its own processing, even if the provider sets no express conditions. The parties' actual functions determine their controller and processor duties. SRC-014, SRC-098, SRC-103
Before asking, the requester should prepare the evidence pack: lawful grounds, defined roles, a necessary and bounded request, safeguards and applicable agreements. This recommended sequence lets the provider assess the proposed disclosure. It does not transfer the requester's responsibilities to the provider.
A DPIA is required before processing on the stated recruitment flow, unless an applicable legal exception is established: health information informs access to an opportunity. This applies the ICO's published trigger; it does not require automated decisions or large scale. Identify the responsible controller, evidence the completed assessment and implement its safeguards. See the DPIA analysis. SRC-018, SRC-100
DSPT remains central assurance for NHS information. It is additional to these duties, and it does not substitute for the assessment or role-specific agreements.
The basis for requiring DSPT
| Question | Conclusion for this flow |
|---|---|
| Is NHS data assurance relevant? | Yes. The service receives NHS patient information. Direct receipt matters even without a connection to the source system. SRC-056 |
| Does non-NHS commissioning remove that expectation? | No. The stated DHSC policy covers processing for any purpose. Identify any additional binding terms. SRC-081 |
| Does UK GDPR itself mandate DSPT? | No. It mandates appropriate security and accountability. Article 28 adds sufficient-guarantee and contract duties where a processor is used. Those duties support assurance but do not prescribe this toolkit. SRC-005, SRC-014, SRC-019 |
| Could an information standard impose a direct duty? | Yes, where the organisation and activity fall within DAPB0086 and the statutory framework. Record that analysis; NHS origin alone is insufficient. SRC-046, SRC-080 |
| Does the NHS Standard Contract automatically bind the contractor? | No. GC21.2 requires annual DSPT assessment in that contract. Establish whether those terms govern this service; non-NHS procurement does not automatically incorporate them. SRC-096 |
| What should the commissioner do now? | Include the mandatory DSPT condition expressly, with evidence, renewal, audit, notification and remedies. This recommendation does not require an assumption that an existing contract already contains it. |
Use the DSPT authority table to record the route. Distinguish a policy requirement, a statutory duty and an agreed contractual obligation in the decision record.
The section 250 definition of health care and its eligible-provider categories are separate from the direct-care purpose test. The NDG example therefore cannot establish that a recruitment contractor falls outside the information-standard legislation. SRC-046, SRC-095
Keep four decisions separate
- Lawful processing: identify each controller and the Article 6 basis, Article 9 condition and applicable safeguards. The contractor's role can differ between assessment, service administration and hosting. A contract label does not decide the role. SRC-001, SRC-003, SRC-014
- Lawful disclosure and collection: establish informed authority, relevant report rights and the minimum information needed. Do not assume that a whole record is necessary. A person's authority to the GP does not waive the recipient's duties. SRC-066, SRC-067, SRC-083
- Organisational assurance: verify the contractor's DSPT period, status, category, covered service and required audit. Resolve subcontractor coverage rather than relying on a group name. SRC-082, SRC-088, SRC-094
- Product and access requirements: assess the software's function and each access route separately. DSPT does not authorise GP Connect use or establish DTAC, clinical-safety or medical-device compliance. SRC-055, SRC-063, SRC-095
AMRA report rights, recruitment law and any sector-specific exceptions require their own scope assessment. If software makes significant decisions without meaningful human involvement, apply the current automated-decision rules. DSPT status does not resolve those questions.
Record a commissioning decision
The recommended decision is: require DSPT before receipt and throughout processing, subject to the defined contractual evidence and renewal terms. Also record any independently applicable statutory or access obligation. Do not describe a proposed condition as already binding.
The purchaser should name the owner who accepts the contractual assurance evidence. The requester should identify the responsible controller and provide current evidence for the provider's disclosure decision, including relevant DPIA findings and security assurance. Record the evidence version, scope, conditions, unresolved actions and review dates. These are distinct decisions; the purchaser's acceptance does not authorise every disclosure or use. SRC-081, SRC-098, SRC-103
The provider should take reasonable steps to check recipient security. The sources do not establish a universal duty to refuse every authorised report solely because DSPT or a preferred document is absent. After receipt, the requester remains responsible for its processing and should keep its readiness evidence and controls current. SRC-083, SRC-098, SRC-103
Use the operating model to record the decision. The remaining evidence is the actual contract, notice applicability, entity map, disclosure documents and published assessment. Those are bounded open questions in the validation queue, not reasons to leave the proposed contract silent.