Who is responsible for data security in your practice, and how has this been formally assigned?

Official wording from NHS England

Assertion 1.1: The organisation has a framework in place to support Lawfulness, Fairness and Transparency

Your organisation's approach to security is owned and directed by senior responsible individuals, with regular discussions driven by individuals who have overall accountability for security.

Whilst data security and data protection is everybody's business, there must be a named person within your organisation who takes overall senior responsibility for data security and protection issues. Their responsibility is to provide senior level leadership and guidance. In the text box, name the person or people within your organisation with overall responsibility for data security and protection, along with their roles. Then, for each person, describe how this responsibility has been formally assigned to them. For instance, this responsibility could form part of their job description, or be noted in the minutes of a management meeting, or be in an email from the appropriate director in your organisation. Your organisation may also have additional specialised roles, for example a Data Protection Officer (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/#:~:text=The%20DPO%20must%20be%20independent,a%20single%20DPO%20between%20them) or a Caldicott Guardian (https://assets.publishing.service.gov.uk/government/uploads/system/uploads/attachment_data/file/1013756/Caldicott_Guardian_guidance_v1.0_27.08.21.pdf). You can read more about data security and protection responsibilities and specialised roles on the Digital Care Hub (https://www.digitalcarehub.co.uk/resource/data-security-and-protection-responsibilities/)