The Data Protection Act requires organisations, including those in the NHS, to process personal data fairly and lawfully.
NHS Digital cannot release patient level data to a commissioning organisation unless it has a data sharing framework contract and a data sharing agreement in place.
If you wish to apply to receive data under a DSA please contact firstname.lastname@example.org
Once an application has been submitted the DSfC Live Service team will review the application and will support the applicant during the process. The application is also reviewed by IGARD ( Independent Group Advising on the Release of Data), who offer recommendation regarding the request for data to NHS Digital's Senior Information Risk Owner (SIRO).
As a commissioning organisation your privacy notice could be subject to a review before a recommendation for approval can be given.
Further guidance about privacy notices, including information about what should be included, can be found on the ICO guidance on privacy notices.