nhs data processing agreement template

NHS Data Processing Agreement

Instructions for Use

• Complete all bracketed fields with the specific details of your organization and the counterparty.
• Ensure that the "Description of Processing" in Schedule A is explicitly aligned with the specific NHS project or service requirements to meet UK GDPR accountability standards.
• Once populated, have both parties sign the document and retain a copy for your records to demonstrate compliance with Article 28 of the UK GDPR.

Parties and Definitions

This Data Processing Agreement (“Agreement”) is entered into on [Date] by and between:

Controller: [Name of NHS Trust or Clinical Commissioning Group], located at [Registered Address] ("Controller").

Processor: [Name of Service Provider/Vendor], located at [Registered Address] ("Processor").

Definitions:

• "Data Protection Legislation" means the UK GDPR, the Data Protection Act 2018, and all applicable laws relating to the processing of personal data.
• "Personal Data," "Special Category Data," "Data Subject," and "Processing" shall have the meanings ascribed to them in the UK GDPR.

Operative Clauses

1. Scope of Processing: The Processor shall process Personal Data only on behalf of the Controller and in accordance with the documented instructions set out in Schedule A.
2. Confidentiality: The Processor shall ensure that all persons authorized to process the Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
3. Security Measures: The Processor shall implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the UK GDPR.
4. Sub-processing: The Processor shall not engage another processor without prior specific or general written authorization of the Controller. The Processor shall ensure that the same data protection obligations as set out in this Agreement are imposed on any sub-processor.
5. Data Subject Rights: Taking into account the nature of the processing, the Processor shall assist the Controller by appropriate technical and organizational measures, insofar as this is possible, for the fulfillment of the Controller’s obligation to respond to requests for exercising Data Subject rights.
6. Breach Notification: The Processor shall notify the Controller without undue delay after becoming aware of a Personal Data breach.
7. Audit Rights: The Processor shall make available to the Controller all information necessary to demonstrate compliance with Article 28 and allow for and contribute to audits, including inspections, conducted by the Controller or an auditor mandated by the Controller.
8. Termination: Upon the end of the provision of services, the Processor shall, at the choice of the Controller, delete or return all Personal Data to the Controller, unless Union or Member State law requires storage of the Personal Data.

Schedule A: Description of Processing

• Nature and Purpose of Processing: [__________]
• Categories of Data Subjects: [__________]
• Types of Personal Data: [__________]
• Duration of Processing: [__________]

Signature and Acknowledgment

For and on behalf of the Controller: Signature: __________ Printed Name: [] Title: [] Date: [__________]

For and on behalf of the Processor: Signature: __________ Printed Name: [] Title: [] Date: [__________]

Disclaimer: This document is a general framework intended for informational purposes. It does not constitute legal advice. Please consult with qualified legal counsel to ensure compliance with specific NHS requirements and local data protection regulations.