UK GDPR accountability and DPIA triage
Connect data protection decisions to evidence, and identify when a project needs a data protection impact assessment.
Read guideGRC in context
Clinics & care organisations
Connect patient information, suppliers and operational continuity.
Begin with your actual activities.
Start with care delivery, staff responsibilities, sensitive information, systems, medical suppliers and service disruption. Data protection, clinical governance and professional or provider regulation have different purposes. This portal covers general organisational GRC; it does not assess clinical safety or replace your regulator’s requirements.
Scope of this starter pack
General organisational GRC for clinics and care organisations. This route does not assess clinical safety, recommend patient-care decisions or replace clinical governance, professional duties or provider-regulator requirements. Do not place patient records in these tools.
Your priorities
- Map sensitive information and the systems, people and suppliers needed to deliver the service.
- Connect processing decisions and important safeguards to evidence that the safeguards operate.
- Practise organisational escalation and continuity with appropriate operational and professional input.
Questions to start with
- Which information, system or supplier dependency could prevent the organisation from maintaining its service?
- Has a materially changed processing activity been screened and its safeguards checked?
- Who distinguishes operational disruption from personal-data and other notification questions?
- What was demonstrated in the last recovery exercise, and what remained an untested assumption?
Bring to the first review
- A service-dependency and information-flow map without patient-identifying details.
- Processing-screening decisions and references to safeguard implementation and testing.
- Supplier responsibility, escalation and continuity arrangements for an important service.
- An exercise record separating discussion outcomes from demonstrated recovery capability.
Make the first meeting useful
- Choose one service and map its information flows and operational dependencies using non-identifying descriptions.
- Inspect the relevant processing assessment, supplier responsibilities and one safeguard’s operating evidence.
- Run a bounded disruption discussion and assign appropriate follow-up tests for unresolved organisational gaps.
Relevant resources
Follow the evidence into the work.
Review suppliers across the whole relationship
Prioritise critical dependencies, ask for relevant evidence, and plan monitoring and exit before a supplier fails.
Read guideIncident and personal data breach escalation
Prepare a clear response route, assess harm and record the reasons for reporting or not reporting a personal data breach.
Read guidePractise disruption before it becomes a crisis
Use a focused scenario to test decisions, dependencies and recovery assumptions, then track the lessons to completion.
Read guideLeave the review with a useful record.
Identify the owner, the evidence you have, the gaps and the next decision. Keep the applicable source and scope beside any conclusion.