National Imaging Registry (NIR) Governance

These resources, templates and assurance documents explain the governance arrangements that support safe, lawful and consistent use of NIR. They set out the responsibilities, requirements and controls that organisations need to understand before participating in the service.

They cover key areas including data sharing, information governance, data protection, clinical safety and supplier assurance, helping organisations understand what is required and apply the right controls consistently.

The National Imaging Registry (NIR) follows NHS digital clinical safety standards.

• DCB0129 applies to the manufacture (design and development) of health IT systems.
• DCB0160 applies to the deployment and use of systems within health and care organisations.

What trusts and imaging networks need to do

Trusts and imaging networks remain responsible for DCB0160 for how NIR is deployed and used locally. This includes:

• local configuration and workflows
• training and standard operating procedures (SOPs)
• operational governance and incident management

Local DCB0160 must be signed off by your Clinical Safety Officer (CSO).

NIR’s national clinical safety work under DCB0129 provides a baseline, but local DCB0160 is still required to address deployment risks and ensure safe use in your setting.

What suppliers provide (to support local DCB0160)

Suppliers remain responsible for DCB0129 for their own products.

Suppliers are expected to provide deployment‑level safety assurance for their NIR integration to support local DCB0160 activities, including:

• interoperability and configuration
• degraded modes and fallback behaviour
• incident and escalation processes

The National Imaging Registry (NIR) is designed to support the safe and secure sharing of diagnostic imaging information for direct patient care.

Participating organisations must have appropriate data security, information governance and data protection arrangements in place before they can use the service.

Data Sharing Arrangement

The Data Sharing Arrangement (DSA) sets out the legal, governance and operational rules for sharing diagnostic imaging information through NIR.

It confirms that NIR may only be used for direct patient care. It must not be used for secondary purposes such as planning, research or other non-direct care activity.

By signing the DSA, participating organisations agree to:

• share data with approved onboarded consumers nationally
• maintain appropriate information governance controls
• maintain a secure outbound network configuration
• use NIR only for acceptable direct care purposes
• provide clear transparency information for patients
• maintain accurate privacy notices aligned to the NIR Privacy Notice
• apply appropriate role-based access controls
• make sure staff are trained in data protection and confidentiality
• manage breaches in line with data protection requirements
• support audit, monitoring and assurance activity
• follow retention requirements
• uphold patient rights

The DSA must be agreed and signed before live access to NIR is enabled.

Data Protection Impact Assessment

Participating organisations must also have a Data Protection Impact Assessment (DPIA) in place.

A DPIA sets out how personal data is processed, why the processing is necessary, what risks may affect patients’ rights and freedoms, and what controls are in place to reduce those risks.

For NIR, the DPIA should describe:

• what diagnostic imaging information is being shared
• why the sharing is necessary for direct care
• who the information may be shared with
• the lawful basis for processing
• how patients are informed
• how access is controlled
• how data security risks are managed
• how any residual risks are reviewed and approved

Further guidance on information governance is available from the NHS Digital Information Governance webpage. 

A template NIR DPIA will be available in July 2026.

Data Security and Protection Toolkit

Organisations participating in NIR must have an in-year acceptable Data Security and Protection Toolkit (DSPT) standard.

The DSPT provides assurance that an organisation has the right cyber security, data protection and information governance controls in place. This includes how the organisation protects systems, manages access, trains staff, handles incidents and keeps patient information secure.

An organisation may not be able to onboard to NIR if it does not meet the required DSPT standard. Continued compliance may also be checked after onboarding.

Further guidance on the Data Security and Protection Toolkit (DSPT), including how to search for an organisation’s published results, is available on the NHS DSPT website.