Skip to main content
Data sharing standard 2 - Processing and Storage Locations

This standard is part of a series of guidance documents to support the various stages of a DARS application.

 

Standard description

Processing means an operation or set of operations which is performed on information. For the avoidance of doubt, storage of data is considered to be a type of processing. As such, all agreements must include the following information.

Processing locations

  1. All organisations related to the location stated must either be listed on the application as a processor, or as a controller who processes, or be NHS Digital (such as online system access)  
  2. The application must list the full postal address of all processing locations. The postal address given must include details of any other organisation if appropriate, and this must be clearly explained in the purpose section of the application.
  3. Each processing location must be within the territory of use stated in the application.

Storage locations

  1. All organisations related to the location stated must either be listed on the application as a processor, or as a controller who processes, or be NHS Digital (such as online system access)
  2. The application must list the full postal address of all storage locations. The postal address given must include details of any other organisation if appropriate, and this must be clearly explained in the purpose section of the application.
  3. Each storage location must be within the territory of use stated in the agreement.

NHS Digital online system access

  1. Where NHS Digital are providing online system access NHS Digital will not be listed as a processor, processing location or storage location in the agreement.
  2. Controllers and all other processors will be detailed in the application as set out above.

Remote access

  1. Where the processing of the data is only carried out at the storage location and only a screen view of the data is provided to the remote device then the remote device location need not be listed as a processing location.
  2. In all other situations all locations must be explicitly stated within the agreement.
  3. In both cases data can only be accessed/viewed within the stated territory of use.

Please note that this standard will be updated shortly for requirements where cloud storage/processing is occuring.

Last edited: 19 August 2019 6:47 am