NATIONAL DATA GUARDIAN 10 STANDARDS REGISTRATION
NATIONAL DATA GUARDIAN 10 STANDARDS CODE
NATIONAL DATA GUARDIAN 10 STANDARDS ISO

Where processing is to be carried out on behalf of a controller, under Article 28 of UK GDPR the controller has a number of responsibilities including that they must only use processors providing sufficient guarantees to implement appropriate technical and organisational measures.ĭetailed guidance has been made available by the Information Commissioner’s Office (ICO) on these responsibilities (see ICO Guide to the UK GDPR: Contracts and liabilities between controllers and processors).

NATIONAL DATA GUARDIAN 10 STANDARDS ISO

you are managing information security in accordance with ISO 27001’s requirements, regardless of the size or type of your organisation.

your information security management system meets the standards of the ISO model of implementation, maintenance and continual improvement.

When you achieve ISO 27001: 2013 certification you are demonstrating that: ISO 27001 structures how organisations should manage risk associated with information security threats, including policies, procedures and staff training.Ĭertification to the ISO 27001 standard is recognised worldwide to indicate that your systems align with information security best practices. ISO 27001:2013 (also known as ISO 27001) is an information security management standard jointly-published by the International Organization for Standardization, and the International Electrotechnical Commission. Learn more about the DSPT ISO 27001:2013 certification All organisations that have access to patient data and systems must use this toolkit to provide assurance that they are practising good data security and that personal information is handled correctly. The DSPT is an online self-assessment tool that allows organisations to measure their performance against the National Data Guardian’s 10 data security standards. UKHSA recognises 2 types of assurance, at least one of which must be demonstrated for each applicant and/or data processor: Should you need to engage a data processor to deliver your project, you must also provide sufficient guarantees that they will implement appropriate technical and organisational measures, and that you will continue ensure their compliance on an ongoing basis. In your application you must demonstrate that your organisation has the appropriate organisational, physical and technical measures to ensure the confidentiality, integrity and availability of the data throughout its processing, including storage at rest. This requires the consideration of factors such as risk analysis, organisational policies, and physical and technical safeguards. The ‘security principle’ is a key principle of the UK General Data Protection Regulation (UK GDPR) that requires you to process personal data securely using appropriate technical and organisational measures.

include a copy of the certificate with the application.

UKHSA will not accept expired certificates, and if the expiration date passes during the review, you will be required to provide updated documentation

demonstrate that the certificate is current.

show that the certificate is valid for the processing locations specified in the application.

the certificate must show the name and address of the certified organisation, as well as the scope and the Statement of Applicability (SOA).

NATIONAL DATA GUARDIAN 10 STANDARDS REGISTRATION

include the certificate number, registration date, and expiration date.

When demonstrating an organisation has in place ISO 27001:2013 certification, the application must:

show that the DSPT assessment result was ‘Standards Met’ or ‘Standards Exceeded’ģ.

demonstrate that the latest available version of the DSPT assessment has been completed, or that the previous version has been completed and the assessment has not expired.

NATIONAL DATA GUARDIAN 10 STANDARDS CODE

include a valid organisation code (referred to as ‘ODS codes’) for the organisation the DSP toolkit is for.

When demonstrating an organisation has in place DSPT, the application must: current ISO 27001:2013 certification issued by an UKAS accredited certification bodyĢ.Data Security and Protection Toolkit ( DSPT) to ‘Standards Met’ or ‘Standards Exceeded’.UKHSA recognises 2 types of assurance, at least one of which must be demonstrated for each applicant and data processor: All applications must demonstrate that each applicant and engaged data processor has in place appropriate technical and organisational measures to protect the confidentiality, integrity and availability of the data requested. This standard must be met for all applications to access UKHSA data classified as ‘Protected’.

Approval standard: data security When must this standard be met

National data guardian 10 standards