If you are starting a COVID-19 related project using personal data, please CHECK WITH YOUR LOCAL DATA PROTECTION OFFICE IF THEY HAVE AN EQUIVALENT “RAPID ASSESSMENT” FORM, otherwise you can use this form and send to your local data protection/information governance team.
Contact details must be available in your local health board website. If you cannot find it, you have contact details for your Data Protection Officer and Caldicott Guardians available here.
By completing this form and submitting the form to your Data Protection Team you have done your best to comply with the reasonable Information Governance requirement for corporate accountability. You can continue with your project. Your Data Protection Office and/or your IG team will advise you if they have any questions.
NOTE: This template does not negate the need for formal documentation to be completed, such as a Data Protection Impact Assessment, or an Information / Data Sharing Agreement. These documents will be completed accordingly and at an appropriate time. Your Data Protection/Information Governance Team will advise accordingly based on this form.
Key Principles to remember:
- Data Protection legislation does not prohibit the collection and sharing of personal data – it provides a framework where personal data can be used with confidence that individual’s privacy rights are respected.
- The starting point is to consider the risks and the potential harm that may arise if we do not share information.
- Always ensure that the objective can be achieved by sharing the minimal personal data possible.
- Remember that processing of personal data must be fair, lawful and transparent.
- Ensure that you have reasonable security measures in place to protect the personal data you are processing.
Further guidance:
Scottish Government IG advice for COVID-19 working – online
Information Commissioner Office advice on Data Protection and Coronavirus