Before requesting identifiable records
Before asking for disclosure, the requester should be able to demonstrate lawful and secure handling of the information. The GP practice or other healthcare provider receives the request and sends the clinical information. The requester, such as a recruitment service, receives and processes that information. These directions do not determine either party's controller or processor role. SRC-001, SRC-014, SRC-098
This chapter separates duties that apply without an express condition, documents required for particular roles or risks, and evidence the requester should provide. It covers England and applicable UK-wide law. No actual request, contract or recipient assessment has been approved.
Preparing the evidence before asking is the recommended sequence. The legal deadline for a mandatory DPIA is before the processing it covers starts, not merely before the clinical information arrives. Applicable lawful grounds, safeguards and required agreements must also govern the actual processing. SRC-014, SRC-018, SRC-103
Does the provider have to state every condition?
No. Contractual silence does not remove the recipient's statutory responsibilities. A recipient controller must establish its lawful grounds, apply the data-protection principles, implement suitable safeguards and demonstrate compliance. Article 24 requires review and updating where necessary. Article 32 also imposes security duties on processors. SRC-003, SRC-004, SRC-005, SRC-019, SRC-103
Confidentiality can arise from the information and circumstances, without an express clause or label. Receipt of a medical report is not permission for unrestricted reuse. The requester must assess confidentiality as well as data protection for its intended use and any onward disclosure. SRC-102
The ICO expects a disclosing organisation to take reasonable steps to check recipient security and resolve material differences before sharing. The recipient takes on its own legal responsibilities; the provider does not thereby become responsible for every subsequent act of an independent controller. A prepared requester should supply evidence that supports those checks. SRC-098
The ICO Data Sharing Code is a statutory code. Its relevant provisions inform regulatory and court assessment, but its good-practice recommendations are not all separate legal requirements. The source register identifies its current DUAA review notices. SRC-105
What is the underlying legal authority?
The requester should explain why it may collect and use this information, not merely why it wants it. Record the purpose, Article 6 basis, Article 9 condition and any required DPA 2018 safeguards. The individual's authority for the provider to disclose does not automatically establish the recipient's UK GDPR basis. SRC-002, SRC-003, SRC-004, SRC-083
For public bodies, identify the relevant legal function or power separately from the UK GDPR basis. Powers can arise from legislation or common law; the actual use must fall within their scope. Check constitutional restrictions, confidentiality and other legal constraints where relevant. Where the Human Rights Act applies, assess Article 8 privacy requirements, including necessity and proportionality. Public-function status requires assessment; a procurement contract is not a blanket permission to obtain records. SRC-102, SRC-076, SRC-079
For employment and similar medical reports, the request should identify the recipient, purpose, information needed and the individual's authority. GMC guidance requires informed, relevant and substantiated disclosure and normally an opportunity to see the report. A targeted report may be sufficient; do not presume a whole record is necessary. Apply the actual report-rights legislation and professional scope. SRC-066, SRC-083
Which agreement or document is required?
“DPA” can mean the Data Protection Act 2018 or a data-processing agreement. Use the full term. Neither is a DPIA.
| Document or arrangement | What the requester must establish |
|---|---|
| Data-processing agreement | Article 28 requires binding written terms or another qualifying legal act where a controller uses a processor. If the requester acts for the commissioner, assess that relationship. Its hosting suppliers may be processors too. Receiving a report does not make it the GP's processor. SRC-014 |
| Controller-to-controller data-sharing agreement | Recommended for a continuing separate-controller flow. Record purposes, roles, lawful grounds, security, onward use, retention, rights and incident handling. It is not universally compulsory under UK GDPR merely because a disclosure occurs; applicable terms or other law may require it. SRC-099 |
| Joint-controller arrangement | Article 26 applies where parties jointly determine purposes and means. Allocate their responsibilities transparently and make the arrangement's essence available to individuals. Shared records alone do not establish joint control. SRC-015 |
| Data protection impact assessment (DPIA) | A controller's assessment before processing that meets a mandatory trigger or is otherwise likely to cause high risk. It examines necessity, proportionality, risks to people and safeguards. SRC-018 |
| Appropriate policy document (APD) | Required by specified DPA 2018 Schedule 1 conditions, including the employment condition in paragraph 1. It addresses compliance procedures, retention and erasure. Assess the selected condition; an APD is not universally required for every Article 9 route. SRC-002 |
| Supporting accountability records | Relevant processing records, notices, security evidence, retention rules and incident/rights procedures. Confirm DPO duties where triggered. These support continuing compliance; a generic assurance statement is insufficient evidence of the actual flow. SRC-001, SRC-016, SRC-017, SRC-103 |
NHS England's universal DSPA guidance provides a combined template for these agreement types. It can be used by other sectors working with health and care. Select the relevant provisions and complete the actual facts; the published template excludes research uses. It does not replace the DPIA. SRC-106
Does the recruitment requester need a DPIA?
On the stated flow, a DPIA is required before the recruitment processing, unless an applicable legal exception is established. The ICO's Article 35(4) list covers decisions about access to an opportunity that involve special-category data. Applying that trigger to medical eligibility for Armed Forces recruitment is this wiki's reasoned application of the published rule. It does not depend on proving automation or large scale. SRC-018, SRC-100
Identify the responsible controller or controllers. A processor must assist and may prepare material, but outsourcing does not transfer the controller's responsibility. Seek the designated DPO's advice. Complete the assessment before the processing starts, implement its safeguards and review it when risks change. If residual high risk requires prior regulator consultation, complete that step before proceeding. SRC-014, SRC-018, SRC-001, SRC-101
A suitable programme assessment can cover similar operations; a separate DPIA for every patient or report is not the requirement. Check that it covers the actual collection, assessment, disclosures, suppliers and retention. SRC-018
Article 35(10) provides a specific exception for Article 6(1)(c) or (e) processing already covered by a DPIA within a general impact assessment required by domestic law. Public-task or MOD status alone does not establish that exception. SRC-018
For other requests, record the trigger assessment. The ICO also recommends DPIAs for planned sharing below the mandatory threshold. The provider separately assesses its own disclosure activity; the requester's DPIA does not automatically settle that assessment. SRC-104
What should accompany the request?
The following is a recommended requester evidence pack, scaled to the sensitivity, volume and continuity of the flow. It combines the duties above with practical assurance. It is not a universal statutory form. SRC-098, SRC-099, SRC-103
| Provide to the GP practice or provider | Purpose of the evidence |
|---|---|
| Requester's legal identity, commissioner, service scope and responsible contact | Establish who will receive information and which controller owns each processing decision. |
| Defined request, necessary fields or report questions, purpose and individual authority | Enable a bounded disclosure decision and avoid unjustified whole-record requests. |
| Role map and recipient's legal grounds | Explain collection, assessment and onward use, including the commissioner's access to clinical detail or only an outcome. |
| DPIA reference, version, date, scope, accountable approval and relevant findings | Show that the assessment covers the proposed flow, safeguards are implemented and remaining risks have been addressed. |
| Applicable agreement and APD confirmation | Demonstrate the correct role-specific terms and any condition-specific statutory safeguards. |
| Security and information-handling evidence | Cover verified transfer destinations, access restrictions, staff confidentiality, hosting/support access, onward recipients, retention, deletion and incident contacts. |
| Privacy information and rights process | Explain what individuals are told and how access, correction, objections and complaints are handled under the applicable rules. |
| DSPT evidence for the organisation receiving NHS patient information | The requester supplies its legal identity, published assessment year and status, covered service and applicable audit evidence. The purchaser checks contractual compliance; the GP practice considers the evidence for its separate disclosure decision. The DSPT chapter describes the evidence and timing. |
The source provider has no general automatic right under Article 35 to receive another controller's complete DPIA. The requester should offer a relevant summary or controlled access sufficient for the disclosure decision. Agree further evidence and audit rights where needed. Sensitive security details may need restricted handling; a summary must still explain the relevant safeguards. SRC-018, SRC-098, SRC-101
Who accepts readiness and keeps it current?
Use a versioned readiness record with a named requester contact, evidence references, unresolved actions and review dates. The responsible controller should record its decision to start the defined processing and the safeguards on which it relies. A processor supplies evidence and assistance within its role. DPO advice informs the assessment; it does not transfer the controller's accountability. This is a recommended way to document the underlying duties. SRC-014, SRC-018, SRC-101, SRC-103
The controller decides whether its processing can start. The purchaser decides whether the contractor has met the agreed DSPT and other contractual conditions. The GP practice or other source provider decides whether to disclose. Each organisation should record its decision, evidence, scope and conditions. The purchaser's acceptance of DSPT evidence does not authorise collection or use; disclosure does not settle the requester's continuing compliance. SRC-087, SRC-098, SRC-103
After receipt, maintain access restrictions, purpose limits, rights handling, incident procedures and retention controls. Review the DPIA when the risk changes and update safeguards where necessary. Keep the evidence pack current when purposes, recipients, suppliers or transfer arrangements change. Notify the provider or purchaser where agreed terms or applicable duties require it. Use the operating model to record actions, owners and closure evidence. SRC-018, SRC-019, SRC-099, SRC-103
Can equivalent assurance replace these requirements?
An alternative format can work; an unrelated badge cannot. An integrated privacy or risk assessment can serve as the DPIA if it fulfils the required assessment and process. A substantially similar existing assessment needs a documented fit to the actual operation. A security review alone does not assess necessity, proportionality and risks to people's rights. SRC-018, SRC-100, SRC-101
DSPT, Cyber Essentials and ISO certification can contribute evidence within their scope. They do not replace the DPIA, lawful grounds, confidentiality authority, required processor terms or an APD where applicable. Nor does a claim of equivalent assurance automatically satisfy a contract that expressly requires DSPT. Under the proposed recruitment condition, the contractor must have acceptable published DSPT status before receiving records and maintain assurance afterwards. The recruitment decision explains the commissioner's recommendation and the limits of existing evidence. SRC-014, SRC-018, SRC-002, SRC-087
For this planned recruitment flow, the requester should resolve material gaps before asking the provider to release information. The provider records its own disclosure decision. This is not a universal rule to refuse every lawful disclosure because one preferred document is absent. Use the operating model and retain unresolved service facts in the validation queue.