Research map and scope
The research expands the image by following the data from source to use, rather than by collecting every law with “health” in its title. The common baseline is followed by conditional branches.
| Research area | Questions resolved here | Read |
|---|---|---|
| Classification and purpose | What is personal, health, confidential, pseudonymised or anonymous? What counts as secondary use? | Legal framework · Confidentiality |
| Permission and accountability | Who decides, what permits the provider's disclosure and recipient's processing, and what evidence is needed? | Legal framework · Operating model |
| Requester readiness | What must the requester have in place before receiving identifiable records or reports, even if the provider states no conditions? | Before requesting records |
| Current legal changes | Which DUAA amendments are now operative? Which older explanations need care? | DUAA 2025 |
| Supply chain and lifecycle | How do cloud hosting, support, security, retention, rights and transfers work? | Data lifecycle |
| NHS data assurance | When does DSPT apply, which entities and services are covered, and how is assurance maintained? | DSPT · Operating model |
| Worked recruitment decision | Which DPIA trigger applies, why require DSPT contractually, and what must the requester demonstrate to the sending provider? | Recruitment: NHS GP records |
| Other NHS requirements | Which information standards, product assessments and access conditions apply? | NHS standards |
| Secondary-purpose approvals | When do CAG, opt-outs, HRA/REC or secure environments matter? | Confidentiality · Operating model |
| Special activities | What changes for medical devices, recruitment, insurance, children, tracking or AI decisions? | Conditional regimes |
Source discipline
Legislation establishes legal rules. Regulators and public authorities explain administration and interpretation. Professional guidance addresses its regulated audience. Contracts can add obligations within their scope. The seed slide and this wiki’s synthesis cannot establish law by themselves.
Sources were checked on 19 October 2026. Current consolidated legislation and commencement instruments take precedence over stale explanatory pages. A Bill is not enacted law; Royal Assent does not prove every provision has commenced. Entries in the source register state authority and limits.
Deliberate limits
Clarified example flows inform general recommendations. No actual dataset, contract or complete service specification has been reviewed. This wiki does not select a lawful basis or approve a specific service. It does not conduct an exhaustive comparison of devolved health systems or foreign law. The legal framework identifies cross-border triggers that would require more work.
The framework remains application-neutral. The worked example tests a clarified recruitment flow and uses published NDG advice as evidence. It does not assess an actual MOD contract or assume a military, intelligence or national-security exemption. Such exemptions require their own legal and factual analysis.
Using the knowledge graph
The 2D and 3D maps expose links between pages, sources and concepts. They help locate evidence; an automatically generated relationship is not a legal inference. Check the source and the evidence matrix.