Our Commitment to Data Protection
At Alliance for Better Care, we take the protection of personal and sensitive data extremely seriously. We are committed to maintaining the highest standards of data security and privacy, ensuring compliance with all applicable UK data protection legislation.
This page outlines our comprehensive approach to data protection, security measures, governance structures, and compliance frameworks that safeguard the information entrusted to us. For information about what data we collect and how we use it, please see our Privacy Notice.
Regulatory compliance and accreditations
Annual Compliance Activities
We complete the Information Commissioner’s Office (ICO) Data Security and Protection Toolkit (DSPT) annually, demonstrating our commitment to meeting the National Data Guardian’s data security standards. Our organisation holds Cyber Essentials accreditation, providing assurance that we have implemented essential cybersecurity controls.
| Compliance Framework | Level | Link to public record |
| NHS Data Security and Protection Toolkit (DSPT) | Standards Exceeded | View online |
| Cyber Essentials | Plus | View online |
Legal Framework
All data is collected, processed, stored, and disposed of in accordance with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Common Law Duty of Confidentiality
- NHS Data Security and Protection Requirements
We maintain full compliance with data security and protection regulations through continuous monitoring, regular assessments, and proactive improvement of our information governance practices.
Governance structure
Leadership & Accountability
Our organisation has established clear accountability for information governance through designated leadership roles:
Senior Information Risk Officer (SIRO)
- Provides strategic oversight of information risk
- Accountable to the Board for information governance
- Champions information risk management across the organisation
Caldicott Guardian
- Ensures patient confidentiality is maintained
- Oversees data sharing involving patient-identifiable information
- Provides expert advice on information governance matters
Information Governance Lead
- Manages day-to-day information governance activities
- Coordinates compliance monitoring and reporting
- Leads policy development and implementation
Independent Data Protection Officer (DPO)
- Provides independent oversight and expert advice
- Reviews and approves data sharing arrangements
- Acts as point of contact with the ICO
- Monitors compliance with data protection legislation
Governance Meetings & Reporting
Our Information Governance Group meets monthly to:
- Review information governance performance and incidents
- Monitor compliance with policies and procedures
- Identify and manage information risks
- Oversee improvement initiatives
The group reports quarterly to our Board Governance Committee, ensuring senior leadership maintains oversight of our information governance performance and strategic risks.
Data management practices
How We Use Data
Direct Patient Care Data is primarily used within the organisation for delivering direct patient care, ensuring healthcare professionals have access to the information needed to provide safe, effective treatment.
Audit & Quality Improvement We utilise data to audit our services and drive quality improvements, ensuring we continuously enhance the care we provide to patients.
Performance Management Anonymised data is used for performance management purposes and to confirm contract delivery to our commissioners, ensuring accountability and transparency.
Record of Processing Activities
All processing activities are documented in our comprehensive Record of Processing Activities (ROPA), which details:
- The purposes of data processing
- Categories of data subjects and personal data
- Recipients of personal data
- Data retention periods
- Technical and organisational security measures
This record is regularly reviewed and updated to reflect changes in our processing activities.
Third-Party Data Sharing
Rigorous Assessment Process
Any data for which we are the controller that is shared with third parties undergoes a comprehensive assessment process:
Data Protection Impact Assessment (DPIA)
- Identifies and evaluates privacy risks
- Assesses necessity and proportionality
- Determines appropriate safeguards
- Documents risk mitigation measures
Copies of our Data Protection Impact Assessments are available upon request.
Data Sharing Agreement (DSA)
- Clearly defines the purpose and scope of data sharing
- Specifies security and confidentiality requirements
- Establishes responsibilities and accountability
- Includes breach notification procedures
Both the DPIA and DSA are reviewed and signed off by our independent DPO before any data sharing agreement is finalised, ensuring robust protection of personal data.
Sub-processor Management
We maintain a comprehensive list of sub-processors who process data on our behalf. For detailed information about our sub-processors, including the purposes for which they process data and their locations, please see our dedicated Sub-processors page.
All sub-processors are subject to:
- Contractual data protection obligations
- Regular compliance monitoring and reviews
- Specific security requirements
- Annual reassessment of arrangements
Security measures
Measures
Clinical System Security
Patient consultations are recorded in appropriate clinical systems with multiple layers of security:
- NHS Smart Card authentication for healthcare professionals
- Two-factor authentication for additional security
- Role-based access controls limiting data access to authorised personnel
- Comprehensive audit trails of all system access and activities
Data Storage & Infrastructure
Secure Cloud Environment All data is stored in a secure, cloud-based UK environment, ensuring:
- Data residency within the United Kingdom
- Compliance with NHS data security standards
- High availability and disaster recovery capabilities
- Regular security updates and patching
Hardware Security All staff hardware is encrypted and equipped with remote data wiping capability, protecting against data loss in the event of device theft or loss.
Data Transmission Security
Data transmitted between systems and users is protected through:
- Transport Layer Security (TLS) encryption for data in transit
- End-to-end encryption for sensitive communications
- Secure file transfer protocols
- VPN connections for remote access
Access Controls
We implement role-based access management to ensure staff can only access data necessary for their role. This includes:
- Regular reviews of user permissions and access rights
- Immediate revocation of access when staff leave or change roles
- Principle of least privilege access
- Strong password policies and regular password changes
Advanced Data Protection Techniques
When required, we employ advanced techniques for handling sensitive data:
- Pseudonymisation to reduce identification risks
- Data masking for test and development environments
- Encryption at rest for particularly sensitive datasets
Self-Assessment & Continuous Improvement
Regular Self-Assessment
We proactively self-assess our information governance practices against:
- Standards outlined in the DSPT
- ICO audit tools and guidance
- NHS Information Governance Toolkit requirements
- Industry best practices
External Audits
Regular external audits are conducted to independently verify our compliance with data protection legislation and information security standards.
Staying Current
Our organisation maintains awareness of evolving data protection requirements through:
- DPO participation in professional forums and networks
- Monitoring of regulatory updates and ICO guidance
- Partnerships with cybersecurity firms
- Engagement with emerging threats and security trends
- Regular review and updating of policies and procedures
Staff training and awareness
Comprehensive Training Programme
All staff receive annual/ regular training on data security and protection, including:
- UK GDPR and Data Protection Act 2018 requirements
- Information security awareness
- Confidentiality and data handling best practices
- Recognising and reporting security incidents
Ongoing Updates
Staff training is regularly updated to address:
- Emerging cybersecurity threats
- Phishing awareness and social engineering tactics
- New policies and procedures
- Lessons learned from incidents (internal and external)
Incident response and breach management
Structured Response Process
In the event of a data breach or security incident, we follow a structured response process:
1. Detection & Identification Immediate identification of the incident through monitoring systems, staff reporting, or third-party notification.
2. Escalation Rapid escalation to the Information Governance Lead and DPO for assessment and coordination and recorded on the data breach log Register.
3. Containment Immediate action to contain the breach and prevent further data loss or unauthorised access.
4. Impact Assessment Comprehensive assessment of the nature, scope, and potential consequences of the breach.
5. Notification Notification of affected individuals where required, providing clear information about the breach and recommended actions.
6. ICO Reporting Reporting to the Information Commissioner’s Office within the 72-hour window required by UK GDPR when necessary.
7. Post-Incident Review Thorough investigation to identify root causes and implement preventive measures.
Learning from Incidents
Every incident is treated as an opportunity for learning and improvement, with findings used to enhance our security measures and staff training.
Contact information
-
Data controller
Alliance for Better Care CIC
Horley Health Hub
120 Victoria Road
Horley
RH6 7BL -
Data Protection Officer
For Alliance for Better Care Head Office and Non-Practice Functions:
Richard Newell (Your-DPO)
Contactable via Alliance for Better Care Head Office (Horley Health Hub)
Making a complaint
If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with:
Information Commissioner’s Office (ICO)
Website: www.ico.org.uk
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate)
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Alliance for Better Care CIC ICO Registration Number: ZA505659
Link to record: Alliance For Better Care CIC | ICO
Document Control
This Data Protection & Compliance statement is reviewed annually and updated as necessary to reflect changes in our practices, regulatory requirements, or organisational structure.
Version: 1.0
Last Updated: February 2026
Next Review Date: January 2027
Owner: Information Governance Lead
Approved By: Senior Information Risk Officer and Data Protection Officer
