NHS England Data Sharing Audit: Nuffield Department of Population Health at University of Oxford
This report records the key findings of a remote data sharing audit of Nuffield Department of Population Health (NDPH) at University of Oxford (UoO) between 11 and 14 May 2026.
Audit summary
Purpose
This report records the key findings of a remote data sharing audit of Nuffield Department of Population Health (NDPH) at University of Oxford (UoO) between 11 and 14 May 2026. It provides an evaluation of how UoO and its Processor conform to the requirements of:
- the data sharing framework contract (DSFC) CON-319043-Y2R5H v2.03
- the data sharing agreement (DSA) DARS-NIC-656885-M7T5X-v4.2
- the organisations’ own policies, processes and procedures
This DSA covers the provision of the following datasets:
| Dataset | Classification of data | Dataset period |
|---|---|---|
|
National Disease Registration Service (NDRS) Cancer Pathway |
Pseudo/Anonymised, Non- sensitive |
November 2024, One-off |
|
NDRS Cancer Registrations |
Pseudo/Anonymised, Sensitive |
July 2024, One-off |
|
NDRS Linked Cancer Waiting Times (Treatments only) |
Pseudo/Anonymised, Sensitive |
July 2024, One-off |
|
NDRS Linked DIDs |
Pseudo/Anonymised, Sensitive |
July 2024, One-off |
|
NDRS Linked HES AE |
Pseudo/Anonymised, Sensitive |
1 April 2007 to 31 March 2020 Historic Held, One-off |
|
NDRS Linked HES APC |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available, One-off |
|
NDRS Linked HES Outpatient |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available |
|
NDRS National Cancer Patient Experience Survey (CPES) |
Pseudo/Anonymised, Sensitive |
Historic Held, One-off
|
|
NDRS National Radiotherapy Dataset (RTDS) |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available, One-off |
|
NDRS Rapid Cancer Registrations |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available, One-off |
|
NDRS Somatic Molecular Dataset |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available, One-off |
|
NDRS Systemic Anti-Cancer Therapy Dataset (SACT) |
Pseudo/Anonymised, Sensitive |
Historic Held, Latest Available, One-off |
|
NDRS Cancer Pathway |
Pseudo/Anonymised, Non Sensitive |
Latest Available, One-off |
|
NDRS Cancer Registrations |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Linked Cancer Waiting Times (Treatments only) |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Linked DIDs |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Linked HES AE |
Pseudo/Anonymised, Sensitive |
1 April 2007 to 31 March 2020, One-off |
|
NDRS Linked HES APC |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Linked HES Outpatient |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS National Radiotherapy Dataset (RTDS) |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Rapid Cancer Registrations |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Somatic Molecular Dataset |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
|
NDRS Systemic Anti-Cancer Therapy Dataset (SACT) |
Pseudo/Anonymised, Sensitive |
Latest Available, One-off |
The Controller is UoO and the Processor is ARROW Business Communication Ltd (ARO).
The DSA allows the Controller to share data with other organisations under a sub-license agreement.
The Applied Health Research Unit (AHRU) within NDPH at UoO requires access to NHS England data for the purpose of the following research programme: ‘Establishing a UK Colorectal Cancer Intelligence Hub. The COloRECTal Cancer Data Repository (CORECT-R)’. The UK Colorectal Cancer Intelligence Hub is a research programme whose aim is to generate high quality bowel cancer information that will improve care and outcomes for patients. It does this through compiling and using datasets relevant to the disease in the CORECT-R.
The interviews during the audit were conducted through video conferencing.
This is an exception report based on the criteria expressed in the Data Sharing Audit Guide version 5.
Audit type and scope
|
Audit type |
Focused |
|---|---|
|
Scope areas |
Information Transfer Data Use and Benefits Operational Management and Control |
|
Restrictions |
Access control - limited visibility of physical controls |
Overall risk statement
Based on evidence presented during the audit and the type of data being shared the following risk has been assigned from the options of Critical - High - Medium - Low.
Current risk statement: Medium
In deriving this risk, the Audit Team takes into account compliance, duty of care, confidentiality and integrity, as appropriate.
Data recipient’s acceptance statement
AHRU and NDPH at UoO has reviewed this report and confirmed that it is accurate.
Data recipient’s action plan
AHRU and NDPH at UoO will establish a corrective action plan to address each finding. The Audit Team will validate this plan and the resultant actions at a post audit review with NDPH to confirm the findings have been satisfactorily addressed. The post audit review will also consider the outstanding evidence at which point the Audit Team may raise further findings.
Findings
The following tables identify the 5 agreement nonconformities, 3 observations, and 1 point for follow-up raised as part of the audit.
| Ref | Finding | Link to area | Clause | Designation |
|---|---|---|---|---|
|
1 |
Data had been processed outside the stated territory of use (UK) and NHS England was not notified. The Audit Team received evidence to confirm this had been remediated during the audit fieldwork. |
Access Control |
DSA Annex A, Schedule 1, Section 2c. |
Agreement nonconformity |
| 2 |
AHRU do not perform and publish a programme of audits in relation to sub-licensees, as required by the Data Sharing Agreement (DSA). |
Operational Management |
DSA, Annex A, Schedule 1 Section 10, clause i |
Agreement nonconformity |
| 3 |
AHRU do not publish a release register including the details of the sub-licensees. This must contain at a minimum the same level of detail as per the NHS England data uses register, as required by the DSA. |
Operational Management |
DSA, Annex A, Schedule 1 Section 10, clause k |
Agreement nonconformity |
| 4 |
The Information Governance (IG) training requirements for sub-licensees was not in line with the DSA and also not in line with UoO internal IG policy requirements. |
Operational Management |
DSFC Schedule 2, Section A, Part 1.2.2 |
Agreement nonconformity |
| 5 |
AHRU had not completed a Record of Processing Activities (RoPA) for the data supplied under the DSA. Instead, information specific to the DSA datasets was spread across separate documents. |
Operational Management |
DSFC, Schedule 2, Section A, clause 1.3 |
Agreement nonconformity |
| 6 |
The AHRU Hub Access Committee (HAC) Terms of Reference (ToR) had not been reviewed since 2022 and contained outdated information. |
Operational Management |
DSA, Annex A, Schedule 1 Section 5a |
Observation |
| 7 |
The detail included within the AHRU HAC minutes relating to the approval of each sub-licensee was limited. |
Use and Benefits |
DSA, Annex A, Schedule 1 Section 10, clause f |
Observation |
| 8 |
At the post audit review, the Audit Team will assess AHRU’s implementation of measures aimed at reducing the number of data touchpoints. |
Information Transfer |
|
Follow-up |
NDPH
| Ref | Finding | Link to area | Clause | Designation |
|---|---|---|---|---|
| 9 | NDPH do not maintain a scheduled review cycle of its internal policies. Instead, policies are reviewed as and when required. However, several outdated policies were identified during the audit. | Operational Management |
DSFC Schedule 2, Section A, part 3.1 |
Observation |
Use of Data
AHRU and NDPH at UoO confirmed that the datasets were only being processed and used for the purposes defined in the DSA and were only being linked with those datasets explicitly allowed in the DSA.
Data Location
AHRU and NDPH at UoO confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the location shown in the following table. These locations conform with the territory of use defined in section 2c of the DSA.
| Organisation | Territory of Use |
|---|---|
|
UoO |
UK |
|
ARO |
UK |
Backup Retention
The duration for which data may be retained on backup media is:
| Organisation | Media Type | Period |
|---|---|---|
|
ARO |
Disk |
7 days |
Disclaimer
The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed.
NHS England has prepared this audit report for its own purposes. As a result, NHS England does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS England does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.
Last edited: 24 July 2026 4:00 pm