# Sources Stable source identities lead to the authority used for each claim. **Checked** means retrieved or inspected for this research; it does not mean independent legal endorsement. Source dates and limitations remain important. Legislation, official guidance, policy, professional standards and the user’s seed have different authority. Rights and retention: remote sources retain their own terms. We store links and original summaries, with only necessary short excerpts. Do not infer redistribution rights from access. UK legislation and many government publications use Crown copyright/OGL terms; check each source’s notice. The local slide is retained for this private task. The Standard’s MIT attribution is preserved separately. No patient records form part of this corpus. | ID | Authority and publication | Status | Checked | Limits and use | |---|---|---|---|---| | SRC-001 | [UK GDPR: revised consolidated legislation](https://www.legislation.gov.uk/eur/2016/679/contents)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Articles 2–4, 8A, 7, 10, 12–21, 25 and 36 checked in the revised legislation. Application to a service remains fact-dependent. | | SRC-002 | [Data Protection Act 2018: Schedule 1](https://www.legislation.gov.uk/ukpga/2018/12/schedule/1/data.html)
UK Parliament | Primary legislation | 2026-10-19 | Conditions must be satisfied on their facts; this source does not establish eligibility for any particular use. | | SRC-003 | [UK GDPR Article 9: special categories of personal data](https://www.legislation.gov.uk/eur/2016/679/article/9/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Read with Article 6, DPA 2018 and separate confidentiality duties. | | SRC-004 | [UK GDPR Article 6: lawfulness of processing](https://www.legislation.gov.uk/eur/2016/679/article/6/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Includes recognised legitimate interests effective in February 2026; no lawful basis has been selected for an actual service. | | SRC-005 | [UK GDPR Article 5: data protection principles](https://www.legislation.gov.uk/eur/2016/679/article/5/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Principles establish duties, not a complete technical implementation specification. | | SRC-006 | [ICO: DUAA summary of changes — data protection](https://ico.org.uk/about-the-ico/what-we-do/legislation-we-cover/data-use-and-access-act-2025/the-data-use-and-access-act-2025-duaa-summary-of-the-changes/data-protection/)
ICO | regulatory-guidance | 2026-10-19 | Explains changes; current statutory wording and commencement instruments take precedence. Not a blanket healthcare permission. | | SRC-007 | [DUAA Commencement No. 6 Regulations 2026, SI 2026/82](https://www.legislation.gov.uk/uksi/2026/82/contents/made)
UK statutory instrument | Secondary legislation | 2026-10-19 | Regs 2–3 establish February and June commencement; savings and transitional provisions can affect earlier processing. | | SRC-008 | [DUAA Commencement No. 9 Regulations 2026, regulation 2](https://www.legislation.gov.uk/uksi/2026/1015/regulation/2/made/data.html)
UK statutory instrument | Secondary legislation | 2026-10-19 | Establishes transfer of regulator functions on 30 September 2026; does not itself define all substantive data protection duties. | | SRC-009 | [UK GDPR Article 84B: additional requirements for research, archiving and statistical purposes](https://www.legislation.gov.uk/eur/2016/679/article/84B/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Direct legislation data.html fetch checked; web-rendering tool could not render this endpoint. Read with Article 84C. | | SRC-010 | [UK GDPR Article 84C: appropriate research safeguards](https://www.legislation.gov.uk/eur/2016/679/article/84C/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Direct legislation data.html fetch checked. Approved medical research is defined in paragraph 5; approval is not assumed. | | SRC-011 | [UK GDPR Article 22A: automated processing and significant decisions](https://www.legislation.gov.uk/eur/2016/679/article/22A/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Meaningful human involvement and significance require assessment of the actual decision process. | | SRC-012 | [UK GDPR Article 22B: restrictions on automated decision-making](https://www.legislation.gov.uk/eur/2016/679/article/22B/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Contains the stricter special-category rule and recognised-legitimate-interests restriction. No decision process assessed. | | SRC-013 | [UK GDPR Article 22C: safeguards for automated decision-making](https://www.legislation.gov.uk/eur/2016/679/article/22C/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Direct legislation data.html fetch checked; read with Article 22A–B and any applicable Article 22D regulations. | | SRC-014 | [UK GDPR Article 28: processor requirements](https://www.legislation.gov.uk/eur/2016/679/article/28/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Contract requirements do not determine factual roles or supply missing lawfulness/confidentiality permission. | | SRC-015 | [UK GDPR Article 26: joint controllers](https://www.legislation.gov.uk/eur/2016/679/article/26/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Joint determination of purposes and means must be established on facts; shared data alone is insufficient. | | SRC-016 | [UK GDPR Article 30: records of processing activities](https://www.legislation.gov.uk/eur/2016/679/article/30/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Relevant special-category processing is not excused by the under-250-person exemption. | | SRC-017 | [UK GDPR Article 37: designation of the data protection officer](https://www.legislation.gov.uk/eur/2016/679/article/37/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Core activities, scale and public-authority status require factual assessment. | | SRC-018 | [UK GDPR Article 35: data protection impact assessment](https://www.legislation.gov.uk/eur/2016/679/article/35/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Includes high-risk and large-scale triggers; source does not establish that every health-data activity requires a DPIA. | | SRC-019 | [UK GDPR Article 32: security of processing](https://www.legislation.gov.uk/eur/2016/679/article/32/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Risk-based duty; specific controls must be selected and tested for the actual service. | | SRC-020 | [UK GDPR Article 33: notification of personal data breaches](https://www.legislation.gov.uk/eur/2016/679/article/33/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Regulator notification threshold differs from the threshold for notifying affected people. | | SRC-021 | [UK GDPR Article 34: communication of breaches to individuals](https://www.legislation.gov.uk/eur/2016/679/article/34/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | High-risk threshold and paragraph 3 exceptions require incident-specific assessment. | | SRC-022 | [UK GDPR Article 46: transfers subject to appropriate safeguards](https://www.legislation.gov.uk/eur/2016/679/article/46/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Current data-protection test verified. Applicability depends on the actual transfer and safeguards. | | SRC-023 | [ICO: Pseudonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/pseudonymisation/)
ICO | regulatory-guidance | 2026-10-19 | Guidance marked under review after DUAA. Recipient-specific anonymity cannot be assumed merely because identifiers were removed. | | SRC-024 | [ICO: What is special category data?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/special-category-data/what-is-special-category-data/)
ICO | regulatory-guidance | 2026-10-19 | Guidance marked under review after DUAA; used for data classification and inferences, not outdated automated-decision wording. | | SRC-025 | [ICO: A brief guide to international transfers](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/a-brief-guide-to-international-transfers/)
ICO | regulatory-guidance | 2026-10-19 | A transfer route must cover the actual entities and facts. This does not establish a destination as adequate or assess its safeguards. | | SRC-026 | [National Health Service Act 2006, section 251](https://www.legislation.gov.uk/ukpga/2006/41/section/251)
UK Parliament | Primary legislation | 2026-10-19 | Definitions and enabling power; not the source of the whole common-law duty. | | SRC-027 | [Health Service (Control of Patient Information) Regulations 2002, regulation 5](https://www.legislation.gov.uk/uksi/2002/1438/regulation/5)
UK Government | Secondary legislation | 2026-10-19 | Approval route is limited to its statutory purposes and conditions. | | SRC-028 | [Health Service (Control of Patient Information) Regulations 2002, regulation 7](https://www.legislation.gov.uk/uksi/2002/1438/regulation/7)
UK Government | Secondary legislation | 2026-10-19 | Controls apply to processing under the Regulations. | | SRC-029 | [Confidential patient information and the Regulations](https://www.hra.nhs.uk/about-us/committees-and-services/confidentiality-advisory-group/confidential-patient-information-and-regulations/)
Health Research Authority | Official guidance | 2026-10-19 | Explains CPI and CAG; distinguish advice from statutory approval. | | SRC-030 | [Guidance for CAG applicants](https://www.hra.nhs.uk/about-us/committees-and-services/confidentiality-advisory-group/guidance-cag-applicants/)
Health Research Authority | Approval guidance | 2026-10-19 | Updated 12 May 2026; actual approval conditions remain project-specific. | | SRC-031 | [Understanding the national data opt-out](https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out)
NHS England | NHS policy | 2026-10-19 | Current published policy contains programme-specific exceptions; recheck at use. | | SRC-032 | [Individual care and research and planning uses of data](https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out/individual-care-and-research-and-planning-uses-of-data)
NHS England | NHS policy | 2026-10-19 | Purpose classification also covers internal repurposing. | | SRC-033 | [Using and disclosing patient information for secondary purposes](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality/using-and-disclosing-patient-information-for-secondary-purposes)
General Medical Council | Professional guidance | 2026-10-19 | Addressed to doctors; does not confer blanket supplier authority. | | SRC-034 | [The Caldicott Principles](https://www.gov.uk/government/publications/the-caldicott-principles)
National Data Guardian | Governance principles | 2026-10-19 | Principles support judgment; they do not replace a legal basis. | | SRC-035 | [Guidance on the appointment of Caldicott Guardians, their role and responsibilities](https://www.gov.uk/government/publications/national-data-guardian-guidance-on-the-appointment-of-caldicott-guardians-their-role-and-responsibilities)
National Data Guardian | Statutory guidance | 2026-10-19 | Have-regard duty has a defined organisational and publicly funded service scope. | | SRC-036 | [Health and Social Care (National Data Guardian) Act 2018, section 1](https://www.legislation.gov.uk/ukpga/2018/31/section/1)
UK Parliament | Primary legislation | 2026-10-19 | Identifies who must have regard to NDG guidance. | | SRC-037 | [Development, deployment and monitoring of data-driven technologies](https://www.hra.nhs.uk/planning-and-improving-research/research-planning/how-were-supporting-data-driven-technology/overview-legal-requirements-using-health-and-care-data-development-and-deployment-data-driven-technologies/3-development-deployment-and-monitoring-data-driven-technologies/)
Health Research Authority | Official guidance | 2026-10-19 | 2022 lifecycle explanation; current amended law prevails over older legal wording. | | SRC-038 | [What approvals do I need?](https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/)
Health Research Authority | Approval guidance | 2026-10-19 | Use decision tools with actual research design; no blanket approval conclusion. | | SRC-039 | [Research Ethics Committee review](https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/research-ethics-committee-review/)
Health Research Authority | Approval guidance | 2026-10-19 | REC and HRA Approval scopes differ. | | SRC-040 | [HRA Approval](https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/hra-approval/)
Health Research Authority | Approval guidance | 2026-10-19 | Updated 28 April 2026; controller permission remains distinct. | | SRC-041 | [Consent in research](https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-guidance/what-law-says/consent-research/)
Health Research Authority | Official guidance | 2026-10-19 | Participation consent is separate from the UK GDPR basis. | | SRC-042 | [Access to Medical Reports Act 1988](https://www.legislation.gov.uk/ukpga/1988/28)
UK Parliament | Primary legislation | 2026-10-19 | Applies to defined doctor-prepared employment/insurance reports; not all health records. | | SRC-043 | [Disclosing information for employment, insurance and similar purposes](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality---disclosing-information-for-employment-insurance-and-similar-purposes/disclosing-information-for-employment-insurance-and-similar-purposes)
General Medical Council | Professional guidance | 2026-10-19 | Doctor duties do not determine the recipient employer’s lawful basis. | | SRC-046 | [Health and Social Care Act 2012, section 250 (current text)](https://www.legislation.gov.uk/ukpga/2012/7/section/250/data.html)
UK Parliament / legislation.gov.uk | Primary legislation | 2026-10-19 | Read with commencement and savings; each standard specifies its addressees. | | SRC-047 | [The Health and Care Act 2022 (Commencement No. 10 and Transitional and Saving Provision) Regulations 2025](https://www.legislation.gov.uk/uksi/2025/807/pdfs/uksi_20250807_en.pdf)
UK Government / legislation.gov.uk | Secondary legislation | 2026-10-19 | Regulation 3 preserves the previous regime for standards already published and in effect before 7 July 2025. | | SRC-048 | [The Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 2](https://www.legislation.gov.uk/uksi/2026/82/regulation/2/made/data.html)
UK Government / legislation.gov.uk | Secondary legislation | 2026-10-19 | Commencement evidence; not proof that every enabled standard or regulation has been made. | | SRC-049 | [Data (Use and Access) Act 2025, Schedule 15](https://www.legislation.gov.uk/ukpga/2025/18/schedule/15/data.html)
UK Parliament / legislation.gov.uk | Primary legislation | 2026-10-19 | Amending provisions; use current legislation and the applicable standard for an implementation decision. | | SRC-050 | [DCB0129: Clinical Risk Management: its Application in the Manufacture of Health IT Systems](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dcb0129-clinical-risk-management-its-application-in-the-manufacture-of-health-it-systems/)
NHS England | information standard | 2026-10-19 | Current release page lists 7 June 2018; applicability and statutory transition require separate assessment. | | SRC-051 | [DCB0160: Clinical Risk Management: its Application in the Deployment and Use of Health IT Systems](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dcb0160-clinical-risk-management-its-application-in-the-deployment-and-use-of-health-it-systems/)
NHS England | information standard | 2026-10-19 | Current release page lists 7 June 2018; assess the deploying organisation's actual role and system. | | SRC-052 | [Applicability of DCB 0129 and DCB 0160: Step by step guidance](https://digital.nhs.uk/services/clinical-safety/applicability-of-dcb-0129-and-dcb-0160/step-by-step-guidance)
NHS England (published as NHS Digital) | official guidance | 2026-10-19 | Last edited August 2022; its statutory quotations predate 2025/2026 changes. Use with savings, current notices and contracts. | | SRC-053 | [Applicability of DCB 0129 and DCB 0160: Background](https://digital.nhs.uk/services/clinical-safety/applicability-of-dcb-0129-and-dcb-0160/background)
NHS England (published as NHS Digital) | official guidance | 2026-10-19 | May 2022 explanation of the previous legal framework and procurement route; not a complete current-law statement. | | SRC-054 | [How Digital Technology Assessment Criteria (DTAC) works](https://digital.nhs.uk/services/digital-technology-assessment-criteria-dtac/how-dtac-works)
NHS England | official assurance guidance | 2026-10-19 | Updated 21 September 2026; a product's intended purpose and use determine scope. | | SRC-055 | [DTAC in relation to other regulatory and assurance processes](https://digital.nhs.uk/services/digital-technology-assessment-criteria-dtac/other-regulatory-and-assurance-processes)
NHS England | official assurance guidance | 2026-10-19 | General summaries do not replace individual laws, standards or deployment assessment. | | SRC-056 | [Data Security and Protection Toolkit: Overview and introductory guidance](https://www.dsptoolkit.nhs.uk/News/3)
NHS England | official assurance guidance | 2026-10-19 | Explains policy and contractual routes; organisation-specific assertions and access conditions vary. | | SRC-057 | [Data Security and Protection Toolkit](https://www.dsptoolkit.nhs.uk/)
NHS England | official assurance service | 2026-10-19 | Dynamic page: 2026–27 version 9 was displayed at the check date. Recheck at the point of use. | | SRC-058 | [Records Management Code of Practice: Section 1, Scope of the code](https://digital.nhs.uk/data-and-information/information-governance/guidance/records-management-code-of-practice/scope-of-the-code)
NHS England | official code of practice | 2026-10-19 | Scope includes NHS/adult-social-care and secondary-use records; not a universal statutory retention schedule. | | SRC-059 | [Records Management Code of Practice: Section 5, Management of records when the minimum retention period is reached](https://digital.nhs.uk/data-and-information/information-governance/guidance/records-management-code-of-practice/management-of-records-when-the-minimum-retention-period-is-reached)
NHS England | official code of practice | 2026-10-19 | Record-specific schedules, continuing need, access requests and legal/inquiry holds affect disposal. | | SRC-060 | [NHS and social care data: off-shoring and the use of public cloud services Guidance](https://digital.nhs.uk/data-and-information/looking-after-information/data-security-and-information-governance/nhs-and-social-care-data-off-shoring-and-the-use-of-public-cloud-services/guidance)
NHS England (published as NHS Digital) | official guidance | 2026-10-19 | Updated May 2022; combine with current transfer law, relevant contract and actual overseas access. | | SRC-061 | [The Network and Information Systems Regulations 2018: guide for the health sector in England](https://www.gov.uk/government/publications/network-and-information-systems-regulations-2018-health-sector-guide/the-network-and-information-systems-regulations-2018-guide-for-the-health-sector-in-england)
Department of Health and Social Care | official statutory guidance | 2026-10-19 | Health-sector OES guidance; it does not fully determine digital-service-provider/cloud scope. | | SRC-062 | [Cyber Security and Resilience (Network and Information Systems) Bill: stages](https://bills.parliament.uk/bills/4035/stages)
UK Parliament | legislative status | 2026-10-19 | As at 19 October 2026, Lords report stage was listed for 26 October 2026. A Bill is not commenced law. | | SRC-063 | [Medical device stand-alone software including apps (including IVDMDs)](https://assets.publishing.service.gov.uk/media/6abf6c8c943e890cb55e5e52/Medical_device_stand-alone_software_including_apps__including_IVDMDs.pdf)
Medicines and Healthcare products Regulatory Agency | official regulatory guidance | 2026-10-19 | Qualification guidance; assess objective intended purpose and current UK MDR. Older embedded regulatory references need checking. | | SRC-064 | [Medical devices: post-market surveillance requirements — Introduction and scope](https://www.gov.uk/government/publications/medical-devices-post-market-surveillance-requirements/introduction-and-scope)
Medicines and Healthcare products Regulatory Agency | official regulatory guidance | 2026-10-19 | Applies within the stated Great Britain device scope from 16 June 2025; not every software service is a device. | | SRC-065 | [Understanding accessibility requirements for public sector bodies](https://www.gov.uk/guidance/accessibility-requirements-for-public-sector-websites-and-apps)
Government Digital Service / Central Digital and Data Office | official guidance | 2026-10-19 | Explains public-sector accessibility and reasonable adjustments; not a complete employment discrimination analysis. | | SRC-066 | [Access to Medical Reports Act 1988](https://www.legislation.gov.uk/ukpga/1988/28/data.html)
UK Parliament / legislation.gov.uk | Primary legislation | 2026-10-19 | Applies to the defined employment/insurance reports and medical practitioners; exceptions and procedural details matter. | | SRC-067 | [Data protection and workers’ health information](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/employment/information-about-workers-health/data-protection-and-workers-health-information/)
Information Commission (ICO) | regulator guidance | 2026-10-19 | Employer power imbalance affects consent; assess the precise purpose, Article 6 basis and Article 9 condition. | | SRC-068 | [Introduction to the Children's code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/introduction-to-the-childrens-code)
Information Commission (ICO) | regulator guidance | 2026-10-19 | The relevant online-service and likely-child-access tests matter; storing children's records alone does not establish code scope. | | SRC-069 | [The Privacy and Electronic Communications (EC Directive) Regulations 2003, current text](https://www.legislation.gov.uk/uksi/2003/2426/data.html)
UK Government / legislation.gov.uk | Secondary legislation | 2026-10-19 | Check current regulation 6/Schedule A1 and regulation 22, including amendments commenced 5 February 2026. | | SRC-070 | [Access to the health and care records of deceased people: guidance for information governance professionals](https://digital.nhs.uk/data-and-information/information-governance/guidance/access-to-the-health-and-care-records-of-deceased-people/guidance-for-ig-professionals)
NHS England | official guidance | 2026-10-19 | Updated 2 September 2026; access routes and restrictions differ by requester and record; living third parties remain protected. | | SRC-071 | [Secure data environment for NHS health and social care data: policy guidelines](https://www.gov.uk/government/publications/secure-data-environment-policy-guidelines/secure-data-environment-for-nhs-health-and-social-care-data-policy-guidelines)
Department of Health and Social Care | Government policy | 2026-10-19 | NHS analysis/research policy, not a universal statutory rule for every health-data service. | | SRC-072 | [Data access policy update](https://www.gov.uk/government/publications/data-access-policy-update)
Department of Health and Social Care | Government policy | 2026-10-19 | Secure-access policy direction; check current data-controller route and contract. | | SRC-073 | [Guidance on the use of storage and access technologies](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guidance-on-the-use-of-storage-and-access-technologies/)
Information Commission / ICO | Regulatory guidance | 2026-10-19 | Finalised 29 April 2026 after DUAA changes; check exceptions by purpose. | | SRC-074 | [Equality Act 2010, section 60](https://www.legislation.gov.uk/ukpga/2010/15/section/60)
UK Parliament | Primary legislation | 2026-10-19 | Pre-offer health enquiries are restricted with defined exceptions. | | SRC-075 | [Data Protection Act 2018, section 185](https://www.legislation.gov.uk/ukpga/2018/12/section/185)
UK Parliament | Primary legislation | 2026-10-19 | Certain contractual terms demanding health records obtained by subject access are void. | | SRC-076 | [Human Rights Act 1998, Schedule 1, Article 8](https://www.legislation.gov.uk/ukpga/1998/42/schedule/1)
UK Parliament | Primary legislation | 2026-10-19 | Privacy interference by public authorities requires lawful, necessary, proportionate justification. | | SRC-077 | [Data (Use and Access) Act 2025 — official collection](https://www.gov.uk/government/collections/data-use-and-access-act-2025)
Department for Science, Innovation and Technology | government-guidance | 2026-10-19 | User-requested research entry point. The collection links guidance and factsheets; it is not a substitute for operative provisions and commencement instruments. | | SRC-078 | [EU General Data Protection Regulation: Article 3 territorial scope](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679)
European Union / EUR-Lex | primary-legislation | 2026-10-19 | Article 3 verified through official EUR-Lex indexed text; direct page rendering returned a bot challenge. Used only for conditional territorial scope, not a full EU-law assessment. | | SRC-079 | [Human Rights Act 1998, section 6](https://www.legislation.gov.uk/ukpga/1998/42/section/6)
UK Parliament | Primary legislation | 2026-10-19 | Consolidated XML checked. Public-authority/public-function scope and statutory exceptions require factual assessment. | | SRC-080 | [DAPB0086: Data Security and Protection Toolkit](https://digital.nhs.uk/data-and-information/information-standards/governance/latest-activity/standards-and-collections/dapb0086-data-security-and-protection-toolkit/)
NHS England | Information-standard notice | 2026-10-19 | Page lists version 8, Amd 21/2025, published 12 August 2025. Identify addressees and relevance before asserting a statutory duty; distinguish the notice from the operational version 9 cycle. | | SRC-081 | [DAPB0086: Data Security and Protection Toolkit — Requirements Specification, version 8](https://digital.nhs.uk/binaries/content/assets/website-assets/data-and-information/information-standards/standards-and-collections/dapb0086-data-security-and-protection-toolkit/dapb0086/0086_v8_2025_08_2025_reqspec.pdf)
NHS England | Information-standard requirements | 2026-10-19 | Sections 7 and 11.1 describe scope, DHSC policy and the separate NHS Standard Contract route. Version 8 categories and deadlines must not be assumed to govern version 9. | | SRC-082 | [DSPT: Organisation types, 2026–27](https://www.dsptoolkit.nhs.uk/Help/5)
NHS England | Official assurance guidance | 2026-10-19 | Organisation type depends on services, contracts and other drivers. Parent coverage requires the relevant services and activities to be included; no category assigned to an actual contractor. | | SRC-083 | [Confidentiality: disclosing information for employment, insurance and similar purposes](https://www.gmc-uk.org/professional-standards/the-professional-standards/confidentiality---disclosing-information-for-employment-insurance-and-similar-purposes/disclosing-information-for-employment-insurance-and-similar-purposes)
General Medical Council | Professional guidance | 2026-10-19 | Paragraphs 4–8 and reproduced paragraph 115 address dual obligations, informed authority and relevant, substantiated disclosure. Whole records should not usually be disclosed for these reports; exceptions and statutory rights need separate assessment. | | SRC-084 | [National data opt-out operational policy guidance: Introduction](https://digital.nhs.uk/services/national-data-opt-out/operational-policy-guidance-document/introduction)
NHS England | NHS policy guidance | 2026-10-19 | Section 1.4 explains “purposes beyond individual care” and individual/direct care. Used as a terminology authority, not to extend opt-out policy to every use. | | SRC-085 | [National data opt-out operational policy guidance: Appendix 2, Definitions](https://digital.nhs.uk/services/national-data-opt-out/operational-policy-guidance-document/appendix-2-definitions)
NHS England | NHS policy guidance | 2026-10-19 | A2.1 defines individual/direct care for this policy, including qualifying local audit. Definitions must be read in context; older legal explanations are not relied on as current consolidated law. | | SRC-086 | [Do clinic AI tools need DTAC and DSPT?](https://www.motics.ai/compliance/dtac-dspt/)
Motics / Dr Harvinder Power | Commercial secondary commentary | 2026-10-19 | User-supplied research prompt, reviewed 10 October 2026. Claims are tested against official sources; no endorsement or vendor compliance assessment. | | SRC-087 | [CAF-aligned DSPT guidance: Introduction](https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/caf-aligned-dspt-guidance/overview/introduction)
NHS England | Official assurance guidance | 2026-10-19 | Explains the health and care overlay, confidentiality and information governance, and the limits of DSPT coverage. CAF-specific structure is not attributed identically to every category. | | SRC-088 | [DSPT: Organisation search](https://www.dsptoolkit.nhs.uk/OrganisationSearch)
NHS England | Official assurance service | 2026-10-19 | Public lookup by organisation name or ODS code. Record period, status and publication date; no actual supplier has been assessed here. | | SRC-090 | Context slide supplied by the user — local seed retained
User-provided research seed | Research seed | 2026-10-19 | Unverified starting map. No inferred authority, instructions, or application scope. | | SRC-091 | [DenchCo Knowledge Base Wiki Standard, pinned revision](https://github.com/denchco/knowledge-base-wiki-standard/tree/d339a0e30de41c4a3260f22c00c96898299a1834)
DenchCo | Implementation standard | 2026-10-19 | Implementation reference only; no healthcare legal authority. | | SRC-092 | [Open Knowledge Format v0.2 specification, pinned revision](https://github.com/GoogleCloudPlatform/open-knowledge-format/blob/ad30107c31c06aec8a7d5636e0d1058118604e6f/SPEC.md)
Google Cloud Platform | Format specification | 2026-10-19 | Implementation reference only; source identity inherited from pinned Standard and independently hash-checked. | | SRC-093 | [DSPT 2026–27 requirements](https://www.dsptoolkit.nhs.uk/News/169)
NHS England | Official assurance requirements | 2026-10-19 | Version 9, CAF 4.0 alignment, assessment structures and 30 June 2027 submission deadline. Check applicable interim or contractual milestones separately. | | SRC-094 | [DSPT 2026–27 audit requirements](https://www.dsptoolkit.nhs.uk/News/170)
NHS England | Official assurance requirements | 2026-10-19 | Current mandatory audit areas distinguish CAF organisations and IT suppliers; do not infer the same audit duty for every category. | | SRC-095 | [National Data Guardian 2023–2024 report, section 6.7.3](https://www.gov.uk/government/publications/national-data-guardian-2023-2024-report/national-data-guardian-2023-2024-report#use-of-gp-connect-by-the-ministry-of-defence-for-pre-employment-checks)
National Data Guardian | Published official advice | 2026-10-19 | Historical advice on proposed MOD fitness-to-serve access through GP Connect. Supports the purpose/access distinction; does not decide DSPT or prohibit all authorised GP reports. | | SRC-096 | [2026/27 NHS Standard Contract: General Conditions, full length, version 1](https://www.england.nhs.uk/wp-content/uploads/2026/01/04-full-length-general-conditions-2526-med-opt-mc.pdf)
NHS England | Published model contract | 2026-10-19 | Cover confirms 2026/27 despite the filename. GC21.2 requires annual published DSPT assessment and applicable mandatory requirements; GC21.6 addresses audit. Does not establish incorporation into an actual MOD or other non-NHS contract. | | SRC-097 | [Introduction to anonymisation](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/anonymisation/introduction-to-anonymisation/)
ICO | Regulatory guidance | 2026-10-19 | Guidance marked under review after DUAA. Anonymous information is outside data-protection law; anonymisation of personal data remains processing. Identifiability and other rules need assessment. | | SRC-098 | [ICO Data Sharing Code: Security](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/security/)
ICO | Statutory-code guidance | 2026-10-19 | Recipient responsibilities and reasonable sender security checks. Guidance marked under review after DUAA; does not grant a universal audit right over separate controllers. | | SRC-099 | [ICO Data Sharing Code: Data sharing agreements](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/data-sharing-agreements/)
ICO | Statutory-code guidance | 2026-10-19 | Separate-controller agreements are good practice, not universally mandatory. Joint-control and processor duties remain distinct. Guidance marked under review after DUAA. | | SRC-100 | [ICO: When do we need to do a DPIA?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/when-do-we-need-to-do-a-dpia/)
ICO | Regulatory guidance and Article 35(4) list | 2026-10-19 | The opportunity/access trigger includes special-category processing without an automation or scale condition. Recruitment application is reasoned synthesis, not an ICO ruling on this service. Guidance marked under review after DUAA. | | SRC-101 | [ICO: How do we do a DPIA?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/how-do-we-do-a-dpia/)
ICO | Regulatory guidance | 2026-10-19 | Controller responsibility, flexible assessment format, DPO advice and implementation. Does not establish a general right for a disclosing GP to the full document. Guidance marked under review after DUAA. | | SRC-102 | [ICO Data Sharing Code: Lawfulness](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/lawfulness/)
ICO | Statutory-code guidance | 2026-10-19 | General legal powers, constitutional restrictions, human rights and implied confidentiality are separate from the UK GDPR lawful basis. No actual MOD power or exemption selected. Guidance marked under review after DUAA. | | SRC-103 | [UK GDPR Article 24: responsibility of the controller](https://www.legislation.gov.uk/eur/2016/679/article/24/data.html)
UK legislation | Legislation — UK GDPR | 2026-10-19 | Demonstrable, risk-appropriate measures and review; policies where proportionate. Does not prescribe one universal recipient-assurance document. | | SRC-104 | [ICO Data Sharing Code: Deciding to share data](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/deciding-to-share-data/)
ICO | Statutory-code guidance | 2026-10-19 | Separates mandatory high-risk DPIAs from recommended use for other sharing. Allows scalable assessment within existing risk frameworks. Guidance marked under review after DUAA. | | SRC-105 | [ICO Data Sharing Code: About this code](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/data-sharing-a-code-of-practice/about-this-code/)
ICO | Statutory-code status guidance | 2026-10-19 | Explains the code's legal relevance and optional good practice. Does not turn every recommendation into a standalone duty. Guidance marked under review after DUAA. | | SRC-106 | [NHS England: Data sharing and processing agreement (DSPA)](https://digital.nhs.uk/data-and-information/information-governance/templates/universal-ig-templates/data-sharing-and-processing-agreement-dspa)
NHS England | Official template guidance | 2026-10-19 | Updated 7 May 2026. Combines role-specific agreements; available for other sectors sharing with health and care. The published universal template excludes research. No completed agreement reviewed. | | SRC-107 | [Your suppliers and contracts (10.1.1–10.3.1)](https://digital.nhs.uk/cyber-and-data-security/guidance-and-resources/data-security-and-protection-toolkit-assessment-guides/guide-10---accountable-suppliers/your-suppliers-and-contracts)
NHS England | Official supplier-assurance guidance | 2026-10-19 | Places supplier DSPT status checks before contract award. Its supplier section permits evidence of an equal or higher standard; current category, contract and access conditions still govern. Not a universal fresh-assessment deadline before procurement starts. | See the [evidence matrix](https://healthcare-data-management-wiki.pages.dev/evidence-matrix/index.md) for claims and the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md) for unresolved questions. Implementation references near the end of the register are not healthcare legal authorities.