Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, what proportion of Federated Data Platform development work is carried out by UK‑based engineers; and whether data processing beyond AWS input processes is off‑shored.

All NHS Federated Data Platform (FDP) development work is carried out by United Kingdom based engineers, therefore there is no offshoring. This is documented in the contract, Information Governance Framework, and Memorandum of Understanding. It is a contractual requirement that personal data stored in the FDP and National Health Service Privacy Enhancing Technology cannot be accessed by its provider’s personnel or contractors based outside the UK. These measures collectively ensure that NHS data remains under UK jurisdiction and that all processing of patient information will be within the UK only. This is a contractual requirement, and one of the key principles of the Federated Data Platform Information Governance Framework. Data cannot be accessed or processed by non-UK Government entities.

Information on how data is protected, who can access it, and under what conditions, is available at the following link:

https://www.england.nhs.uk/long-read/overarching-data-protection-impact-assessment-dpia-for-the-federated-data-platform-fdp/#18-in-which-country-territory-will-personal-data-be-stored-or-processed