<!-- Derived Markdown alternate of recruitment-assurance.md; canonical repository sources and registered evidence retain authority. -->


# Recruitment: NHS GP records

**The commissioning organisation should make DSPT a mandatory contract condition for the recruitment contractor receiving identifiable NHS GP records or reports.** For an MOD commission, this is the MOD's procurement decision. Under the recommended condition, the contractor must have acceptable published DSPT status before receiving records and maintain assurance throughout processing. This recommendation follows NHS policy; it does not establish that an existing statute or contract already imposes the condition. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081)

## The flow being assessed

A GP practice sends identifiable clinical information directly to a contracted service, with the individual's authority. The service uses it to assess medical eligibility for recruitment. The commissioner is outside NHS commissioning. This worked example examines that flow; it does not claim to have reviewed an actual contract, supplier assessment or dataset.

Medical judgement does not make every purpose individual care. In its 2023–24 report, the National Data Guardian considered MOD requests for GP Connect access for fitness-to-serve decisions. It classified that purpose as beyond direct care and did not support the proposed access. That published advice concerns GP Connect's purpose restriction. It does not prohibit every consented GP report. Nor does it decide DSPT applicability. [SRC-095](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-095)

## What the requester must have ready

The recruitment service is the **requester and recipient of information**. The GP practice or other healthcare provider is the **recipient of the request and sender of information**. The requester must govern its own processing, even if the provider sets no express conditions. The parties' actual functions determine their controller and processor duties. [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

Before asking, the requester should prepare the [evidence pack](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md#what-should-accompany-the-request): lawful grounds, defined roles, a necessary and bounded request, safeguards and applicable agreements. This recommended sequence lets the provider assess the proposed disclosure. It does not transfer the requester's responsibilities to the provider.

**A DPIA is required before processing on the stated recruitment flow, unless an applicable legal exception is established:** health information informs access to an opportunity. This applies the ICO's published trigger; it does not require automated decisions or large scale. Identify the responsible controller, evidence the completed assessment and implement its safeguards. See [the DPIA analysis](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md#does-the-recruitment-requester-need-a-dpia). [SRC-018](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-018), [SRC-100](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-100)

NHS policy requires the organisation processing NHS patient information to provide annual DSPT assurance, including for recruitment purposes. The contractor completes and publishes the assessment; the purchaser checks its evidence. DSPT does not replace the required DPIA or role-specific agreements. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056), [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081)

## The basis for requiring DSPT

| Question | Conclusion for this flow |
|---|---|
| Is NHS data assurance relevant? | Yes. The service receives NHS patient information. Direct receipt matters even without a connection to the source system. [SRC-056](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-056) |
| Does non-NHS commissioning remove that expectation? | No. DHSC policy covers organisations processing NHS patient information for any purpose. Additional duties can arise from applicable statutory standards, contract clauses or system-access terms. [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081) |
| Does UK GDPR itself mandate DSPT? | No. It mandates appropriate security and accountability. Article 28 adds sufficient-guarantee and contract duties where a processor is used. Those duties support assurance but do not prescribe this toolkit. [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014), [SRC-019](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-019) |
| Could an information standard impose a direct duty? | Yes, where the organisation and activity fall within DAPB0086 and the statutory framework. NHS origin alone does not establish that the standard binds the contractor. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080) |
| Does the NHS Standard Contract automatically bind the contractor? | No. GC21.2 requires annual published DSPT assessment and compliance with applicable mandatory requirements where that contract governs the service. A non-NHS procurement does not automatically incorporate it. [SRC-096](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-096) |
| What should the commissioner do now? | The commissioning organisation should include the [mandatory DSPT condition](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#recommended-contract-condition) in the service contract, with evidence, annual submissions, applicable audit, notification and remedies. This is a recommendation for the actual contract, not a finding about terms already agreed. |

The commissioner's decision record should identify DHSC policy, any applicable statutory duty and the agreed contractual obligation separately. The [DSPT authority table](https://healthcare-data-management-wiki.pages.dev/dspt/index.md#what-makes-dspt-mandatory) explains each basis.

The section 250 definition of health care and its eligible-provider categories are separate from the direct-care purpose test. The NDG example therefore cannot establish that a recruitment contractor falls outside the information-standard legislation. [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-095](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-095)

## Keep four decisions separate

1. **Lawful processing:** identify each controller and the Article 6 basis, Article 9 condition and applicable safeguards. The contractor's role can differ between assessment, service administration and hosting. A contract label does not decide the role. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014)
2. **Lawful disclosure and collection:** establish informed authority, relevant report rights and the minimum information needed. Do not assume that a whole record is necessary. A person's authority to the GP does not waive the recipient's duties. [SRC-066](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-066), [SRC-067](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-067), [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083)
3. **Organisational assurance:** the contractor supplies its legal identity, assessment year, published status, service coverage and applicable audit evidence. The purchaser checks that the evidence covers the contracted service and participating organisations; a group name alone does not establish coverage. [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-088](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-088), [SRC-094](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-094)
4. **Product and access requirements:** assess the software's function and each access route separately. DSPT does not authorise GP Connect use or establish DTAC, clinical-safety or medical-device compliance. [SRC-055](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-055), [SRC-063](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-063), [SRC-095](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-095)

AMRA report rights, recruitment law and any sector-specific exceptions require their own scope assessment. If software makes significant decisions without meaningful human involvement, apply the current [automated-decision rules](https://healthcare-data-management-wiki.pages.dev/legal-framework/index.md#automated-decisions-retain-strict-health-data-rules). DSPT status does not resolve those questions.

## Record a commissioning decision

Under the recommended contract, **the contractor must have published DSPT Standards Met or Standards Exceeded status before receiving identifiable NHS GP information**. The contractor must maintain assurance throughout processing. The commissioning organisation should specify the assessment period, annual submission deadlines and any earlier contractual milestone. Its decision record should identify independent statutory or access obligations separately. No actual contract has been reviewed.

The purchaser should name the owner who accepts the contractual assurance evidence. The requester should identify the responsible controller and provide current evidence for the GP practice's disclosure decision, including relevant DPIA findings and security assurance. Each organisation should record the evidence version, scope, conditions, unresolved actions and review dates supporting its decision. The purchaser's acceptance does not authorise every disclosure or use. [SRC-081](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-081), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

The provider should take reasonable steps to check recipient security. The sources do not establish a universal duty to refuse every authorised report solely because DSPT or a preferred document is absent. After receipt, the requester remains responsible for its processing and should keep its [readiness evidence and controls current](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md#who-accepts-readiness-and-keeps-it-current). [SRC-083](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-083), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098), [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103)

The [operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) describes the purchaser's acceptance record and the contractor's continuing evidence. The actual contract, notice applicability, entity map, disclosure documents and published assessment remain open questions in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md).