Validation queue
This queue separates unanswered application questions from evidence-backed statements of general rules. Clarified data flows inform the recommendations, but no contract or dataset has been reviewed. A complete service assessment cannot be replaced by general citations.
The bounded recruitment decision is resolved as a recommendation: make DSPT an explicit mandatory contract condition for direct GP records. The open questions below concern existing obligations, exact coverage and lawful implementation. They do not leave that recommendation undecided.
| ID | Open question | Why it remains open | Reopen when |
|---|---|---|---|
| VAL-001 | Actual purpose, fields, scale and identifiability | No actual dataset or complete processing inventory reviewed | A complete processing inventory and relevant data specification are supplied |
| VAL-002 | Controller/processor roles and Article 6/9 routes | Contracts and decision-making facts are unknown | Responsible organisations and purposes are identified |
| VAL-003 | Confidentiality gateway and source permission | No report request, consent wording or disclosure terms reviewed | Those documents are supplied for a defined flow |
| VAL-004 | NDOO, CAG, HRA/REC and research conditions | No research design, approval or policy exception supplied | The activity is classified and protocol supplied |
| VAL-005 | Exact DCB/DTAC/information-standard applicability | Relevant notice applicability, full function, contracts and deployment have not been assessed | Supplier and commissioning specifications and terms are supplied |
| VAL-006 | Cloud access, transfers, retention and exit | No supply chain, countries or record classes supplied | Architecture and contract schedules exist |
| VAL-007 | Clinical device, AI, employment and other special regimes | No complete functional specification or applicable legal exceptions assessed | Functions, decision effects and the relevant legal context are documented |
| VAL-008 | Independent review of legal synthesis | Research was agent-assisted, not independently signed off | A qualified reviewer is appointed for a defined decision |
| VAL-009 | Currency at implementation | Laws, guidance, standards and agreements can change | An actual implementation or later research update is requested |
| VAL-010 | Exact DSPT statutory or contractual route, assessment period and entity coverage | Contract, disclosure terms, legal-entity map and relevant notice applicability have not been assessed | Those documents and organisation details are supplied |
| VAL-011 | Requester assessment, agreements and readiness evidence | No actual DPIA, role-specific terms, APD, provider request pack or claimed statutory exception reviewed | Those materials are supplied for the defined flow |
The recruitment DPIA trigger is addressed in requester readiness. VAL-011 concerns the actual assessment and implementation, not whether the published trigger exists.
Bounded source issues
| ID | Issue | Treatment now | Evidence |
|---|---|---|---|
| CUR-001 | Some ICO and NHS guidance retains older wording | Prefer operative legislation; retain guidance only for supported explanations | SRC-023, SRC-024, SRC-052 |
| CUR-002 | DCB detailed guidance predates s250 amendments | Combine current text, saved older standards and actual notices; no blanket supplier mandate | SRC-046, SRC-047, SRC-052 |
| CUR-003 | Cyber Security and Resilience legislation is a Bill at the check date | Treat proposed extensions as future possibilities | SRC-062 |
| CUR-004 | EU GDPR retrieval used official indexed text where direct rendering was challenged | Retain only a conditional territorial-scope pointer; it is outside the main UK assessment | SRC-078 |
| CUR-005 | The operational DSPT offers 2026–27 version 9; the information-standard page still lists version 8 | Keep the notice and operational cycle distinct. The version 9 notice specifies 30 June 2027; confirm any earlier required milestone and actual category | SRC-080, SRC-082, SRC-093 |
Each item is parked: blocked_by is the missing fact or review above; reopen_when is the stated trigger; last_checked is 2026-10-19. There is no scheduled monitoring or automatic promotion of evidence status.
Use the evidence matrix to inspect supported claims and the operating model to resolve application questions.