Top tips

Here are some tips from social care providers like yourself to help you through the process of completing the toolkit and registering for, and working with, NHSmail.

Records of processing activities (ROPA)

The toolkit requires you to share details of your records of processing activities (ROPA). The ROPA must clearly map who you share personal data with both within and outside your organisation.

Its purpose is to map your data flows, rather than to record each episode of data sharing.

The Information Commissioners Office has useful tips about the ROPA and mapping data flows and states that the ROPA should be updated regularly to reflect the current situation regarding how you process personal data. 

Other information

Contractual requirements for Cloud storage

NHS or Local Authority service contracts often include restrictions on the physical location of data storage so if you hold one we recommend you check that your Cloud storage arrangements comply. The ICO website has more information on how Cloud storage works.   

EU transition and data adequacy

On 28 June 2021, the EU officially adopted the adequacy decisions allowing data to continue to flow freely into the UK. Please refer to the Care Provider Alliance and Digital Social Care briefing for care providers for actions that care providers need to take and further information.