Draft for review by a Clinical Safety Officer. Adapt it to your practice before use.
DPIA (UK GDPR Article 35) · Assess stage
Data protection impact assessment (DPIA)
Oakfield Surgery (a made-up practice)
| Practice | Oakfield Surgery |
|---|---|
| Tool and supplier | Kestrel Consult, Kestrel Health Ltd |
| DPIA version and date | 1.0, 18/02/2026 |
| Completed by | Jo Reid, practice manager |
| Data Protection Officer | Our DPO service |
1. Why we need a DPIA
What the tool does and why a DPIA is needed
Patients send requests, including health information, through our website and the NHS App. This is new technology processing special category data about many patients, so a DPIA is required.
2. The data
Follow the data from start to finish. Ask the supplier for their data flow diagram, or draw your own as boxes and arrows, then list each flow in the table.
| # | From → to | What moves | How |
|---|---|---|---|
| 1 | Patient → tool | The request: symptoms, any photos, name, date of birth, contact details | Online form on the website or NHS App, encrypted |
| 2 | Tool → Heron Link → EMIS | Name, date of birth and NHS number to find the patient, then the request | Heron Link, another company, runs the link |
| 3 | Tool → staff | The request | Staff log in to the tool; access by role |
| 4 | Staff → EMIS | Notes, codes and actions | Typed by staff, who open the patient in EMIS separately |
| 5 | Staff → patient | The reply | Sent from the tool by text or email to the contact details given |
| Question | Answer |
|---|---|
| Whose data? | Registered patients, and parents or carers acting for them |
| What data? | Name, date of birth, NHS number, contact details, the request including symptoms and any photos |
| Where does it come from? | Patients, through the online form. Reception enters phone requests. |
| Where is it stored, and in which country? | Supplier's cloud servers in the UK |
| Who can see it? | Care navigators, clinicians and the practice manager, by role. Supplier support staff only when we ask them to help. Heron Link, the integration partner that links the tool to EMIS, passes details through but doesn’t use them. |
| Is any of it shared or sent on? | Relevant parts are copied into the GP record. Nothing else is shared. |
| How long is it kept? | In the tool for 90 days after the request is closed, then deleted. The record keeps what matters. |
| Does the supplier use it for anything else, such as training AI? | No. The contract rules this out unless the data is anonymised. |
| How many people? | About 9,000 registered patients; around 900 requests a month |
3. Is it lawful?
| Question | Answer |
|---|---|
| Our role | Controller. The supplier is our processor. |
| Lawful basis (UK GDPR Article 6) | 6(1)(e): a task in the public interest, providing NHS care |
| Condition for health data (Article 9) | 9(2)(h): providing health care |
| Confidentiality | Used for direct care, so implied consent applies. Patients are told in our privacy notice. |
| Data processing agreement in place? | Yes, signed 10/02/2026 |
| Supplier's DSPT status | Standards Met, 2025-26 |
4. Who we asked
Who was consulted and what they said
DPO (advice below). Caldicott Guardian: content with the access controls. Patient participation group: asked for clear guidance on what to put in the form. Supplier: provided their DPIA, hosting details and DSPT.
5. Is it necessary and in proportion?
Do we need all of this data? Could we do it with less? How do we tell patients and support their rights?
The form asks only for what's needed to handle the request. Free text is needed for clinical requests. The privacy notice and website explain the tool. Patients can still phone or call in. Rights requests are handled through our usual process.
6. Risks to people's privacy
For each risk, score likelihood (remote, possible, probable) and severity (minimal, significant, severe) to give an overall rating (low, medium, high). The clinical risks go in the hazard log, not here.
| Risk | Likelihood | Severity | Overall |
|---|---|---|---|
| Staff add notes or send a message to the wrong patient because the tool and EMIS don’t open the same patient | Possible | Significant | Medium |
| A reply reaches someone other than the patient | Possible | Significant | Medium |
| Heron Link, the integration partner, handles patient details when linking the tool to EMIS | Possible | Significant | Medium |
| Too many staff can read requests | Possible | Significant | Medium |
| Data is stored outside the UK | Remote | Significant | Low |
| The supplier uses requests to train or improve its product | Possible | Significant | Medium |
| Requests are kept longer than needed | Probable | Minimal | Low |
7. What we're doing about them
| Risk | Measures | Residual risk | Approved? |
|---|---|---|---|
| Wrong patient open in EMIS | Check name, date of birth and NHS number in both systems before adding or sending; close each record when finished; wrong-record entries corrected and reported as a data breach | Low | Yes |
| Reply reaches the wrong person | Check who the reply goes to before sending; sensitive replies ask the patient to phone | Low | Yes |
| Integration partner handles data | Named as a subcontractor in the supplier’s agreement on the same terms; UK storage; DSPT completed | Low | Yes |
| Too many staff can read | Access by role; access log checked monthly | Low | Yes |
| Stored outside the UK | UK hosting written into the contract | Low | Yes |
| Supplier reuses data | Contract rules it out unless anonymised | Low | Yes |
| Kept too long | Deleted 90 days after closing | Low | Yes |
8. Sign-off
| Item | Name and date | Notes |
|---|---|---|
| Measures approved by | Jo Reid, 18/02/2026 | |
| Remaining risk accepted by (SIRO or partner) | Dr Helen Marsh, 23/02/2026 | All residual risks low |
| DPO advice given | DPO service, 16/02/2026 | Add retention period to privacy notice |
| DPO advice accepted or overruled? | Accepted | If overruled, say why |
| Caldicott Guardian consulted | Dr Tom Hughes, 12/02/2026 | |
| Next review | June 2026, then yearly |
If a high risk remains that you can't reduce, you must consult the ICO before you start. Your DPO will advise.