Do you keep an up-to-date Information Asset Register (IAR) and Record of Processing Activities (ROPA), and review them regularly?

Official wording from NHS England

Assertion 1.1: The organisation has a framework in place to support Lawfulness, Fairness and Transparency

Does your organisation maintain an up to date information asset register (IAR) and a record of processing activities (ROPA) and review this regularly?

To be compliant with data protection legislation you must keep a register of all of the information your organisation stores, shares and receives. You should have an Information Asset Register (IAR) that details where and how the information is held and how you keep it safe. You should also have a list of the types of personal data that are shared with others, for example needs assessments, prescriptions, payslips, care plans. This list is called a Record of Processing Activities (ROPA) and should detail how the data is shared and how your organisation keeps it safe. You can combine these into one register, but it is fine to have two separate documents. The register should have been reviewed and approved by the management team at least once in the last twelve months. Example templates for the ROPA and IAR are available from Digital Care Hub (https://www.digitalcarehub.co.uk/data-protection-and-cyber-security/how-to-document-your-data-processing/).