# NHS legal framework and information rights A clinical information flow needs several distinct justifications. A valid data-protection basis does not, by itself, resolve confidentiality or permit a national service connection. This reference uses NHS England as its baseline. It identifies material devolved differences and leaves undocumented Defence arrangements unknown. Public sources were checked on **16 October 2026**. Worked examples below are proposed methods for developing COPPER TIGER. They are not findings that a particular MOD flow is authorised. Read this with [governance](https://copper-tiger.pages.dev/governance/index.md), [information flows](https://copper-tiger.pages.dev/information-flows/index.md) and [interoperability](https://copper-tiger.pages.dev/interoperability/index.md). This detailed reference informs the wider [programme definition](https://copper-tiger.pages.dev/programme-definition/index.md) and [internal Defence architecture](https://copper-tiger.pages.dev/architecture/index.md). Apply its distinctions inside Defence and then at [national/regional interfaces](https://copper-tiger.pages.dev/national-regional-integration/index.md). It is not an exhaustive programme scope or blanket approval for any purpose. ## Keep the legal questions separate | Question | Correct term | What the decision must establish | |---|---|---| | Why may this organisation perform the activity? | Statutory function, power or duty | Identify the applicable provision and its scope; distinguish permission from an obligation | | Why may it process personal data for this purpose? | Article 6 lawful basis | Record the basis and why the processing is necessary where that basis requires necessity | | Why may it process health information? | Article 9 condition | Record the applicable special-category condition, domestic provision and safeguards | | Why may confidential information be used or disclosed? | Common law duty of confidentiality | Identify consent, applicable legal authority or a justified public-interest disclosure | | Why may this person use this route? | Access authorisation and service eligibility | Check the person's role and purpose, plus the service's approved use and onboarding rules | The first four questions concern different legal requirements. The last also concerns service and operational controls. An interface specification cannot answer them all. [SRC-043](https://copper-tiger.pages.dev/sources/index.md#src-043) [SRC-044](https://copper-tiger.pages.dev/sources/index.md#src-044) [SRC-046](https://copper-tiger.pages.dev/sources/index.md#src-046) [SRC-032](https://copper-tiger.pages.dev/sources/index.md#src-032) ## Data and purpose terminology **Personal data** concerns an identified or identifiable living person. **Processing** includes reading, storing, matching, changing and disclosing data. A read-only screen therefore still processes personal data. **Health data** is a special category. A coded identifier does not automatically make a dataset anonymous: pseudonymisation separates identifying information but can leave people identifiable. [SRC-059](https://copper-tiger.pages.dev/sources/index.md#src-059) **Confidential patient information** is a separate statutory term in section 251 of the NHS Act 2006. Its definition combines patient information, identifiability and an obligation of confidence. Do not use it as an exact synonym for every item of personal data. [SRC-047](https://copper-tiger.pages.dev/sources/index.md#src-047) **Direct care**, also called **individual care** in NHS policy, concerns the person's care and treatment and the support needed to deliver it. The relevant definition depends on the guidance or service being applied. Administrative staff can support direct care; a clinical job title does not make every activity direct care. [SRC-046](https://copper-tiger.pages.dev/sources/index.md#src-046) [SRC-049](https://copper-tiger.pages.dev/sources/index.md#src-049) For this concept, state the actual purpose before using broad labels such as *secondary use*. Treatment, service planning, research, recruitment and command decisions need separate descriptions. Occupational medicine is expressly included within the statutory health-or-social-care condition. That does not establish authority to disclose a full clinical history to an employer. [SRC-045](https://copper-tiger.pages.dev/sources/index.md#src-045) [SRC-033](https://copper-tiger.pages.dev/sources/index.md#src-033) ## Article 6, Article 9 and the Data Protection Act An Article 6 basis is required for personal-data processing. Health data also requires an Article 9 condition. Selecting Article 9(2)(h) does not remove the Article 6 requirement. [SRC-043](https://copper-tiger.pages.dev/sources/index.md#src-043) For a proposed NHS public-task flow, investigate **Article 6(1)(e)** and the law establishing the organisation's task. Where a specific legal obligation requires processing, investigate **Article 6(1)(c)**. Neither is established simply by writing “NHS purposes” in a form. Record the relevant function or obligation. [SRC-043](https://copper-tiger.pages.dev/sources/index.md#src-043) **Article 9(2)(h)** covers specified health and social care purposes. Its safeguards include processing by, or under the responsibility of, a professional bound by secrecy, or another person with the required obligation. The domestic condition is **Data Protection Act 2018, Schedule 1, Part 1, paragraph 2**. It covers preventive and occupational medicine, working-capacity assessment, diagnosis, care, treatment and service management. Check the secrecy requirements in Article 9(3) and section 11. [SRC-044](https://copper-tiger.pages.dev/sources/index.md#src-044) [SRC-045](https://copper-tiger.pages.dev/sources/index.md#src-045) Other purposes may need different conditions. **Article 9(2)(g)** concerns substantial public interest and requires an applicable domestic condition; **9(2)(i)** concerns public health. **9(2)(j)** concerns specified research, statistical and archiving purposes with safeguards. “Public interest” is not one interchangeable permission across these provisions. Some Schedule 1 conditions require an **appropriate policy document**. That document requirement does not apply identically to every condition. [SRC-044](https://copper-tiger.pages.dev/sources/index.md#src-044) [SRC-045](https://copper-tiger.pages.dev/sources/index.md#src-045) ### Changes under the Data (Use and Access) Act 2025 The government's commencement account records most Part 5 data-protection changes taking effect on **5 February 2026**. It also records the regulator's functions transferring to the **Information Commission on 30 September 2026**. Source titles retained in this wiki may still use “ICO”. Royal Assent and commencement are distinct dates. [SRC-054](https://copper-tiger.pages.dev/sources/index.md#src-054) The regulator's lawful-basis guide was updated on **2 April 2026**. It now lists seven bases, including **Article 6(1)(ea), recognised legitimate interest**. Its listed purposes include defence, but this basis cannot support a public authority's performance of its official tasks. It also does not replace the health-data condition or confidentiality assessment. [SRC-043](https://copper-tiger.pages.dev/sources/index.md#src-043) Some special-category, sharing and DPIA guidance still displays a review notice. Read each notice alongside the amended law; do not infer that all reform provisions remain uncommenced. [SRC-044](https://copper-tiger.pages.dev/sources/index.md#src-044) [SRC-050](https://copper-tiger.pages.dev/sources/index.md#src-050) [SRC-051](https://copper-tiger.pages.dev/sources/index.md#src-051) ## Consent and confidentiality Use precise labels for different decisions: | Label | Meaning in the concept | |---|---| | Consent to treatment | Agreement to the proposed clinical intervention; keep this distinct from information-use permissions | | Consent for confidentiality | Agreement to use or disclose confidential information; may be explicit or implied in the appropriate circumstances | | UK GDPR consent | A specific data-protection basis with requirements including genuine choice and an affirmative indication | | Explicit consent for special-category processing | An Article 9 condition requiring an express statement and the applicable consent safeguards | | Service permission or patient preference | A system-specific decision; inspect what it controls rather than assuming it supplies every legal basis | GMC guidance permits reliance on implied consent for relevant direct-care sharing when its conditions are met. Patients need accessible information, there must be no reason to believe they object, and recipients must respect confidentiality. If access would surprise the patient, the guidance calls for explicit consent unless obtaining it is impracticable. [SRC-046](https://copper-tiger.pages.dev/sources/index.md#src-046) UK GDPR consent raises particular concerns where an employer or public authority holds power over the individual. A signed form alone does not demonstrate freely given consent. Do not describe confidentiality's implied-consent model as Article 9 explicit consent. [SRC-044](https://copper-tiger.pages.dev/sources/index.md#src-044) For the proposed design, store each permission or objection with its **purpose, recipient or recipient class, data scope, date and effect**. A single `consent=true` flag would conceal these differences. This is a project design inference from the separate requirements above. ## Section 251 is different from section 251B | Provision | Role | Limit | |---|---|---| | **NHS Act 2006, section 251** | Enables regulations concerning patient information for medical purposes; supports the confidentiality framework commonly called section 251 support | Does not disapply data-protection legislation | | **Health Service (Control of Patient Information) Regulations 2002** | Provide the regulatory routes used for specified processing without consent, including the regulation 5 support process | The activity and its conditions matter; approval is not a general entitlement to records | | **Health and Social Care Act 2012, section 251B** | Creates a conditional duty to share for an individual's health or adult social care in England | Subject to statutory conditions, exceptions, data protection and common-law duties | | **Health and Social Care Act 2012, section 251C** | Defines the terms and relevant bodies for that duty | Establish whether the actual provider and service fall within scope | The Confidentiality Advisory Group (CAG) advises on research and non-research applications. HRA applicant guidance describes access outside the direct-care team in **England and Wales**. Section 251 support gives a controller a possible legal route to disclose without consent; it does not compel that controller to provide access. Specify the exact flows, identifiers, purposes and approval conditions. [SRC-047](https://copper-tiger.pages.dev/sources/index.md#src-047) [SRC-048](https://copper-tiger.pages.dev/sources/index.md#src-048) The section 251B duty is a different provision in a different Act. Do not abbreviate both as “s251 permission”. Its Defence application remains a question about the actual arrangement. [SRC-034](https://copper-tiger.pages.dev/sources/index.md#src-034) [SRC-035](https://copper-tiger.pages.dev/sources/index.md#src-035) ## National data opt-out and other objections England's **national data opt-out** concerns in-scope confidential patient information used beyond individual care, such as research and planning. It does not prevent individual-care sharing. It is also not a universal veto: the policy contains conditions and exceptions, including mandatory legal disclosures and specified approvals or exemptions. A lawful basis remains necessary whether a person has opted out or not. [SRC-049](https://copper-tiger.pages.dev/sources/index.md#src-049) Keep a national data opt-out separate from a patient's objection to a particular direct-care disclosure. The latter requires its own confidentiality assessment. Do not translate either automatically into deletion of the clinical record or withdrawal from all services. [SRC-046](https://copper-tiger.pages.dev/sources/index.md#src-046) [SRC-049](https://copper-tiger.pages.dev/sources/index.md#src-049) For implementation, record which preference service applies to each flow and where its decision is enforced. The legal assessment must precede choosing a preference flag. A Defence recipient's eligibility and the status of a particular cross-boundary disclosure remain unknown unless public evidence establishes them. ## Roles, agreements and risk assessment A **controller** determines purposes and means. A **processor** acts on a controller's behalf. Joint control depends on joint determination, not merely on sharing an application. The DPHC notice names MOD as controller; it does not resolve every NHS–MOD processing arrangement. [SRC-031](https://copper-tiger.pages.dev/sources/index.md#src-031) [SRC-012](https://copper-tiger.pages.dev/sources/index.md#src-012) A **data sharing agreement (DSA)** records how parties will share data, with purposes, roles, security, rights handling and review arrangements. It is good practice and supports accountability; it is not itself a statutory power. The agreement cannot cure unlawful disclosure. [SRC-050](https://copper-tiger.pages.dev/sources/index.md#src-050) Distinguish this from the required **Article 26 arrangement** for joint controllers and **Article 28 contract or other legal act** for processor activity. A hosting supplier, an independent clinician and a recipient organisation do not acquire the same role simply because they receive data. [SRC-059](https://copper-tiger.pages.dev/sources/index.md#src-059) A **data protection impact assessment (DPIA)** assesses risks to people's rights and freedoms. Article 35 requires one before processing likely to result in high risk; large-scale special-category processing is an express trigger. The proposed combination of longitudinal health information, multiple services and employment contexts needs documented screening. A DPIA records assessment and mitigation; it does not supply an absent legal basis. [SRC-051](https://copper-tiger.pages.dev/sources/index.md#src-051) The **Caldicott Principles** add practical questions about justified purpose, necessity, minimum information, need-to-know access and patient understanding. They also recognise the importance of sharing for individual care. Difficult confidentiality judgements may need a Caldicott Guardian. These principles guide decisions; they do not replace legislation. [SRC-055](https://copper-tiger.pages.dev/sources/index.md#src-055) ## Retention, correction and patient rights The architecture must provide routes for information, access, rectification, restriction, objection and other applicable rights. A subject access request concerns access to personal data; it is not the same workflow as clinician-to-clinician record transfer. [SRC-053](https://copper-tiger.pages.dev/sources/index.md#src-053) **Article 20 data portability** is a defined right with conditions, including automated processing based on consent or contract. It does not apply to public-task processing in the same way. The project's broader goal of portable clinical history should therefore not be presented as an automatic Article 20 entitlement. **Erasure** also has grounds and exceptions; it is not an unconditional right to delete a clinically necessary history. [SRC-059](https://copper-tiger.pages.dev/sources/index.md#src-059) NHS England's Records Management Code requires appraisal when the minimum retention period and business need have ended. Minimum periods are not automatic deletion instructions. Legal proceedings, inquiries and access requests can affect disposal. Continued retention needs a documented reason and review. Use the applicable record class and organisation's authorised policy; do not impose one lifetime for every message, source record, access log and local cache. [SRC-052](https://copper-tiger.pages.dev/sources/index.md#src-052) For COPPER TIGER, a proposed correction workflow should preserve who changed what, when and why. It should notify relevant recipients where required and distinguish corrected clinical content from the previous version. Shared care views should not conceal the source or silently replace another author's record. The exact technical implementation remains a design decision. ## Material differences across the UK UK data-protection rules coexist with different national health systems, confidentiality arrangements and operational policies. This table identifies reference boundaries, not four complete implementation specifications. | Nation | Material reference difference | Consequence for the concept | |---|---|---| | England | National data opt-out and the section 251B duty have specified England scope | Assess the service, purpose and disclosure against those scopes | | Wales | HRA guidance describes the section 251 application route for England and Wales. WASPI supplies a Welsh framework and distinct sharing, disclosure, joint-controller and processing templates | Use the relevant Welsh agreement and approval arrangements; do not assume the England opt-out is a UK-wide service | | Scotland | The Scottish Government describes the Public Benefit and Privacy Panel for Health and Social Care as scrutinising non-direct-care access to NHS Scotland data | A Scottish data access proposal needs the relevant Scottish process; do not substitute CAG support automatically | | Northern Ireland | HSC's Privacy Advisory Committee publishes its own confidentiality code and supporting guidance | Establish the applicable Northern Ireland authority and process; the cited code's last described review was 2018 | The Scottish source is a **2023 strategy**, useful for the governance distinction rather than proof of every current application route. Northern Ireland's older reference requires care after subsequent legislative changes. These sources do not establish current Defence interfaces in any nation. [SRC-049](https://copper-tiger.pages.dev/sources/index.md#src-049) [SRC-048](https://copper-tiger.pages.dev/sources/index.md#src-048) [SRC-058](https://copper-tiger.pages.dev/sources/index.md#src-058) [SRC-056](https://copper-tiger.pages.dev/sources/index.md#src-056) [SRC-057](https://copper-tiger.pages.dev/sources/index.md#src-057) ## A practical flow decision record The following is a **proposed COPPER TIGER design artefact**, informed by the legal distinctions above. Complete one record for each materially different purpose and recipient. An ADT notification, discharge letter, shared-record query and command report may need different records even when they concern one patient. | Field | Proposed content | |---|---| | Flow identity | Stable identifier, version, owner and review date | | Purpose | Specific clinical, administrative, occupational or other outcome | | Parties and scope | Sender, recipient, controllers/processors, jurisdiction and patient cohort | | Information | Identifiers, clinical items, correspondence/event type and necessary detail | | Authority | Relevant statutory function/power/duty; Article 6 basis; Article 9 condition and domestic provision | | Confidentiality | Consent or other justification, patient expectations, objections and exceptions | | Preferences | Applicable opt-out or service preference, check point and enforcement behaviour | | Access and route | Eligible service, authenticated role, care relationship, destination and permitted actions | | Accountability | Agreement, DPIA, audit events, clinical task owner and escalation | | Lifecycle | Correction, rights requests, retention, local copies and disposal | | Evidence status | Public source and date; unresolved fact recorded as unknown | ### Worked hypothetical example Assume an NHS hospital in England sends a discharge summary to the patient's DMS primary-care team for continuing treatment. This example does not assert that a particular electronic route is available. 1. Define the purpose as continuing that patient's care. Identify the actual legal entities and authorised destination. 2. Assess Article 6 and Article 9 conditions for each party. Record the legal function, health-care condition and secrecy safeguards being relied upon. 3. Assess confidentiality, what the patient expects and any relevant objection. Do not use a recruitment consent form as the justification. 4. Assess the national data opt-out policy by purpose. Individual-care correspondence is outside that policy's opt-out, but other confidentiality requirements remain. 5. Select an eligible transport and agreed content standard. Specify receipt, clinical review and action ownership separately. 6. If command later requests an employment report, create a separate decision record. Select justified conclusions and restrictions rather than automatically forwarding the discharge summary. This method brings legal decisions into the [clinical information flow](https://copper-tiger.pages.dev/information-flows/index.md). It does not turn a plausible basis into a confirmed MOD permission. The public sources establish principles and reference mechanisms; undocumented local arrangements remain unknown. Continue with [GP Connect capabilities and constraints](https://copper-tiger.pages.dev/interoperability/index.md) to examine service eligibility and assurance alongside the purpose-specific legal decision.