# Validation queue This queue separates **unanswered application questions** from evidence-backed statements of general rules. Clarified data flows inform the recommendations, but no contract or dataset has been reviewed. A complete service assessment cannot be replaced by general citations. The [bounded recruitment decision](https://healthcare-data-management-wiki.pages.dev/recruitment-assurance/index.md) is resolved as a recommendation: make DSPT an explicit mandatory contract condition for direct GP records. The open questions below concern existing obligations, exact coverage and lawful implementation. They do not leave that recommendation undecided. | ID | Open question | Why it remains open | Reopen when | |---|---|---|---| | VAL-001 | Actual purpose, fields, scale and identifiability | No actual dataset or complete processing inventory reviewed | A complete processing inventory and relevant data specification are supplied | | VAL-002 | Controller/processor roles and Article 6/9 routes | Contracts and decision-making facts are unknown | Responsible organisations and purposes are identified | | VAL-003 | Confidentiality gateway and source permission | No report request, consent wording or disclosure terms reviewed | Those documents are supplied for a defined flow | | VAL-004 | NDOO, CAG, HRA/REC and research conditions | No research design, approval or policy exception supplied | The activity is classified and protocol supplied | | VAL-005 | Exact DCB/DTAC/information-standard applicability | Relevant notice applicability, full function, contracts and deployment have not been assessed | Supplier and commissioning specifications and terms are supplied | | VAL-006 | Cloud access, transfers, retention and exit | No supply chain, countries or record classes supplied | Architecture and contract schedules exist | | VAL-007 | Clinical device, AI, employment and other special regimes | No complete functional specification or applicable legal exceptions assessed | Functions, decision effects and the relevant legal context are documented | | VAL-008 | Independent review of legal synthesis | Research was agent-assisted, not independently signed off | A qualified reviewer is appointed for a defined decision | | VAL-009 | Currency at implementation | Laws, guidance, standards and agreements can change | An actual implementation or later research update is requested | | VAL-010 | Exact DSPT statutory or contractual route, assessment period and entity coverage | Contract, disclosure terms, legal-entity map and relevant notice applicability have not been assessed | Those documents and organisation details are supplied | | VAL-011 | Requester assessment, agreements and readiness evidence | No actual DPIA, role-specific terms, APD, provider request pack or claimed statutory exception reviewed | Those materials are supplied for the defined flow | The recruitment DPIA trigger is addressed in [requester readiness](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md). VAL-011 concerns the actual assessment and implementation, not whether the published trigger exists. ## Bounded source issues | ID | Issue | Treatment now | Evidence | |---|---|---|---| | CUR-001 | Some ICO and NHS guidance retains older wording | Prefer operative legislation; retain guidance only for supported explanations | [SRC-023](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-023), [SRC-024](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-024), [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052) | | CUR-002 | DCB detailed guidance predates s250 amendments | Combine current text, saved older standards and actual notices; no blanket supplier mandate | [SRC-046](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-046), [SRC-047](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-047), [SRC-052](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-052) | | CUR-003 | Cyber Security and Resilience legislation is a Bill at the check date | Treat proposed extensions as future possibilities | [SRC-062](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-062) | | CUR-004 | EU GDPR retrieval used official indexed text where direct rendering was challenged | Retain only a conditional territorial-scope pointer; it is outside the main UK assessment | [SRC-078](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-078) | | CUR-005 | The operational DSPT offers 2026–27 version 9; the information-standard page still lists version 8 | Keep the notice and operational cycle distinct. The version 9 notice specifies 30 June 2027; confirm any earlier required milestone and actual category | [SRC-080](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-080), [SRC-082](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-082), [SRC-093](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-093) | Each item is parked: `blocked_by` is the missing fact or review above; `reopen_when` is the stated trigger; `last_checked` is **2026-10-19**. There is no scheduled monitoring or automatic promotion of evidence status. Use the [evidence matrix](https://healthcare-data-management-wiki.pages.dev/evidence-matrix/index.md) to inspect supported claims and the [operating model](https://healthcare-data-management-wiki.pages.dev/operating-model/index.md) to resolve application questions.