If you or your suppliers process patient data outside the UK, have you risk-assessed it and put the right governance in place?

Official wording from NHS England

Assertion 10.2: Basic due diligence has been undertaken against each supplier that handles personal information

If you or your suppliers process identifiable patient/ service user information outside the UK, have you appropriately risk-assessed the processing, and put relevant governance in place?

If identifiable patient/ service user information is not processed, outside the UK, then tick and write "Not applicable" in the comments box. If you have selected yes or no, you must consider how clear governance has been followed for example: By completing a data protection impact assessment (DPIA) for the processing which reflects that data is being transferred internationally. If the data processing is happening outside the European Union, you have updated your privacy information to inform your patients and service users. Your international data processing adheres to the relevant contractual agreements such as HSCN/SPINE agreement Being covered by an appropriate transfer mechanism as stipulated within appropriate transfer mechanisms. If your organisation/suppliers do not process identifiable patient/service user information outside of the UK, then tick and write "Not applicable" in the comments box.