Responsibilities of parties involved. The parties are registered Data Controllers under the Data Protection Act. A list of expected types of signatories is at Appendix A. Apart from health bodies who will sign locally, signatories are those who have signed this agreement on the Information Sharing Gateway. Each signatory to the agreement is a Data Controller in own right. All parties confirm that they comply with data protection legislation by: ● having a lawful basis for processing and sharing personal data. ● ensuring data quality. ● storing and sharing information securely, with access management controls. These should be documented in the organisation’s information security policies and procedures. ● having policies and procedures for compliance with data protection legislation including for managing data subject rights & complaints, identifying and managing data breaches/incidents and retention & disposal. ● ensuring that mandatory training is undertaken regularly by their employees to ensure they are clear and up to date on their responsibilities. Every individual must uphold the principles of this agreement and overarching confidentiality, and seek advice from the relevant Data Protection Officer when necessary. ● undertaking appropriate data protection due diligence checks with any contractors/data processors they employ, and ensuring that a written agreement is in place with each data processor, and that all data processors will be bound by this agreement. ● having written processes for the processing of data to ensure employees use and share personal data in line with data protection law, the data protection principles, and this agreement. The parties recognise that any one of them may share data with non-core agencies where relevant to the individual case, and that such sharing is outside the scope of this Agreement. Organisations and their staff must consult the organisation’s Data Protection Officer/Information Governance Manager and/or Caldicott Guardian if they are unsure at any point in the processing and sharing of personal data.
Responsibilities of parties involved. The parties are registered Data Controllers under the Data Protection Act. A list of type of signatories is at Appendix A. All parties confirm that they comply with data protection legislation by: ● having a lawful basis for processing and sharing personal data. ● ensuring data quality. ● storing and sharing information securely, with access management controls. ● having policies and procedures for compliance with data protection legislation including for managing data subject rights and complaints, identifying and managing data breaches/incidents and retention & disposal. ● ensuring that mandatory training is undertaken regularly by their employees to ensure they are clear and up to date on their responsibilities. Every individual must uphold the principles of this agreement and overarching confidentiality, and seek advice from the relevant Data Protection Officer when necessary. ● undertaking appropriate data protection due diligence checks with any contractors/data processors they employ, and ensuring that a written agreement is in place with each data processor, and that all data processors will be bound by this agreement. ● having written processes for the processing of data to ensure employees use and share personal data in line with data protection law, the data protection principles, and this agreement. Organisations and their staff must consult the organisation’s Data Protection Officer/Information Governance Manager and/or Caldicott Guardian if they are unsure at any point in the processing and sharing of personal data.
