Question to the Department of Health and Social Care:

To ask His Majesty's Government what the current policy and practice is for (1) requesting independent advice, oversight, and assurance on potential internal data disseminations within NHS England and the Department of Health and Social Care, and (2) deciding which projects do not require such advice.

Decisions on whether additional advice, oversight, or assurance are required for a particular project are based on the nature of the processing activity and the level of privacy and confidentiality risk identified through the relevant assessment processes.

Under statutory guidance issued on 23 May 2023, NHS England is required to seek advice from the Advisory Group for Data (AGD) on specific data access requests, including internal use of specific data, and to support the development and maintenance of precedents, standards, and guidance on data access. AGD publishes its minutes online.

NHS England also undertakes annual assurance of its information governance and security arrangements through the Data Security and Protection Toolkit. Independent auditors are commissioned to review supporting evidence before the annual submission is finalised.