{"text_format":"1","workbook":"xlsx","n_sheets":14,"sheets":["Introduction","Dashboard","Master sheet","Tables & graphs","Lookup","1. Informed decision making","2. Privacy information","3. Legality risks benefits","4. Data sharing agreement&logs","5. Accuracy quality retention","6. Info security","7. Disclosures","8. Bulk transfers personal info","9. Urgent emergency info share"],"not_rendered":{"charts":12,"images":1,"macros":1,"external_links":0,"defined_names":11,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Introduction","index":0,"n_rows":6,"n_cols":2,"rows_kept":6,"cut":false,"hidden":false,"merged":[[5,1,42,15],[4,1,4,15]]}
[]
[]
[]
[]
[null,"Data Sharing Toolkit Tracker"]
[null,"\nYou can use this Tracker to record and track your actions once you have read the toolkit. \n\nThe first tab is called ‘Dashboard’. The dashboard will update automatically when you fill in the spreadsheet.\n\nThe next tab is called ‘Master Sheet’. This shows the toolkit and records all your responses in one place.\n\nWe have suggested some columns to help you to build your own action plan and improve your compliance. However, as the spreadsheet contains formula we would not recommend altering any of the existing columns. If you do make changes, you may impact the dashboard, master sheet or general functionality. Please note that we cannot offer support for maintaining the spreadsheet.\n\nKey phrases:\n\nCurrent status – This refers to whether you are ‘fully meeting our expectation’, ‘partially meeting our expectation’, or ‘not meeting our expectation’. You can also record the status as ‘not applicable’ to your organisation. You can choose the status from a drop-down list.\n\nReasons for status – You can record the reasons why you have chosen the ‘Current status’ for this expectation.\n\nActions – You can describe what you need to do next to meet the expectation.\n\nAction Owner(s) – You can specify who is responsible for the action.\n\nAction Status – You can choose what stage the action is at from a drop-down list. \n\nDue Date – You can record when you expect to complete the action.\n\n\n\nThe Data Protection Audit Framework, including the Tracker, is available under the terms of the Open Government Licence v3.0."]

{"sheet":"Dashboard","index":1,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":false,"merged":[]}

{"sheet":"Master sheet","index":2,"n_rows":93,"n_cols":16,"rows_kept":93,"cut":false,"hidden":false,"merged":[[0,0,0,3],[2,1,9,1],[2,2,9,2],[2,0,9,0],[10,1,16,1],[10,2,16,2],[10,0,16,0],[17,1,22,1],[17,2,22,2],[23,1,25,1],[23,2,25,2],[17,0,25,0],[26,0,45,0],[46,1,51,1],[46,2,51,2],[52,1,54,1],[52,2,54,2],[46,0,54,0],[26,2,29,2],[30,2,35,2],[42,2,45,2],[36,2,41,2],[26,1,29,1],[30,1,35,1],[36,1,41,1],[42,1,45,1],[65,1,69,1],[65,2,69,2],[55,0,69,0],[70,1,72,1],[70,2,72,2],[55,1,60,1],[55,2,60,2],[61,1,64,1],[61,2,64,2],[87,1,92,1],[87,2,92,2],[87,0,92,0],[73,1,77,1],[73,2,77,2],[70,0,77,0],[78,1,86,1],[78,2,86,2],[78,0,86,0]]}
["Data Sharing Tracker\nMaster Sheet"]
["Category","Number","Our expectations","Reference","Ways to meet our expectations ","Current Status","Reasons for Status","Action(s)","Action owner","Action Status","Completion date\n(DD/MM/YYYY)",{"$f":"IF(ISBLANK('1. Informed decision making'!K1),\"\",'1. Informed decision making'!K1)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!L1),\"\",'1. Informed decision making'!L1)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!M1),\"\",'1. Informed decision making'!M1)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!N1),\"\",'1. Informed decision making'!N1)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!O1),\"\",'1. Informed decision making'!O1)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.1","\tImplement clear policies, procedures and guidance about data sharing, including who has the authority to make decisions about systematic data sharing or one-off disclosures, and when it is appropriate to do so.",{"$f":"IF(ISBLANK('1. Informed decision making'!E2),\"\",'1. Informed decision making'!E2)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F2),\"\",'1. Informed decision making'!F2)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G2),\"\",'1. Informed decision making'!G2)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H2),\"\",'1. Informed decision making'!H2)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I2),\"\",'1. Informed decision making'!I2)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J2),\"\",'1. Informed decision making'!J2)","v":""}]
[{"$f":"A3","v":"Informed decision making"},1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.2","\tIdentify staff that are likely to have responsibility for data sharing decision-making and ensure they have appropriate training, including induction and refresher training. ",{"$f":"IF(ISBLANK('1. Informed decision making'!E3),\"\",'1. Informed decision making'!E3)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F3),\"\",'1. Informed decision making'!F3)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G3),\"\",'1. Informed decision making'!G3)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H3),\"\",'1. Informed decision making'!H3)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I3),\"\",'1. Informed decision making'!I3)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J3),\"\",'1. Informed decision making'!J3)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.3","\tEnsure that staff who are likely to make decisions about sharing children's information complete specific training. ",{"$f":"IF(ISBLANK('1. Informed decision making'!E4),\"\",'1. Informed decision making'!E4)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F4),\"\",'1. Informed decision making'!F4)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G4),\"\",'1. Informed decision making'!G4)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H4),\"\",'1. Informed decision making'!H4)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I4),\"\",'1. Informed decision making'!I4)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J4),\"\",'1. Informed decision making'!J4)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.4","\tDocument all sharing decisions for audit, monitoring and investigation purposes (eg use the data sharing decision form template in the ICO's data sharing code).",{"$f":"IF(ISBLANK('1. Informed decision making'!E5),\"\",'1. Informed decision making'!E5)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F5),\"\",'1. Informed decision making'!F5)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G5),\"\",'1. Informed decision making'!G5)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H5),\"\",'1. Informed decision making'!H5)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I5),\"\",'1. Informed decision making'!I5)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J5),\"\",'1. Informed decision making'!J5)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.5","\tInvolve the DPO in the decision-making process.",{"$f":"IF(ISBLANK('1. Informed decision making'!E6),\"\",'1. Informed decision making'!E6)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F6),\"\",'1. Informed decision making'!F6)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G6),\"\",'1. Informed decision making'!G6)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H6),\"\",'1. Informed decision making'!H6)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I6),\"\",'1. Informed decision making'!I6)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J6),\"\",'1. Informed decision making'!J6)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.6","\tDocument any advice from the DPO or other people involved in the decision-making process. ",{"$f":"IF(ISBLANK('1. Informed decision making'!E7),\"\",'1. Informed decision making'!E7)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F7),\"\",'1. Informed decision making'!F7)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G7),\"\",'1. Informed decision making'!G7)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H7),\"\",'1. Informed decision making'!H7)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I7),\"\",'1. Informed decision making'!I7)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J7),\"\",'1. Informed decision making'!J7)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.7","\tUndertake a data protection impact assessment (DPIA), or at least complete DPIA screening, to assess and work out how to mitigate any risks in proposed data sharing activities. ",{"$f":"IF(ISBLANK('1. Informed decision making'!E8),\"\",'1. Informed decision making'!E8)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F8),\"\",'1. Informed decision making'!F8)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G8),\"\",'1. Informed decision making'!G8)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H8),\"\",'1. Informed decision making'!H8)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I8),\"\",'1. Informed decision making'!I8)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J8),\"\",'1. Informed decision making'!J8)","v":""}]
["Informed decision making",1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.8","\tKeep policies related to systematic and one-off sharing under regular review to ensure these remain up-to-date and effective.",{"$f":"IF(ISBLANK('1. Informed decision making'!E9),\"\",'1. Informed decision making'!E9)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!F9),\"\",'1. Informed decision making'!F9)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!G9),\"\",'1. Informed decision making'!G9)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!H9),\"\",'1. Informed decision making'!H9)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!I9),\"\",'1. Informed decision making'!I9)","v":""},{"$f":"IF(ISBLANK('1. Informed decision making'!J9),\"\",'1. Informed decision making'!J9)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.1","\tMake privacy information publicly available and ensure it actively informs people what information you are sharing, who you are sharing it with and the purpose for the sharing, in line with the requirements under article 13 UK GDPR (unless an exemption applies).",{"$f":"IF(ISBLANK('2. Privacy information'!E2),\"\",'2. Privacy information'!E2)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F2),\"\",'2. Privacy information'!F2)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G2),\"\",'2. Privacy information'!G2)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H2),\"\",'2. Privacy information'!H2)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I2),\"\",'2. Privacy information'!I2)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J2),\"\",'2. Privacy information'!J2)","v":""}]
[{"$f":"A11","v":"Privacy information"},2.1,"People are informed about their personal information being shared.","2.1.2","\tUse plain and age-appropriate language within privacy information to ensure it is accessible to the audience. ",{"$f":"IF(ISBLANK('2. Privacy information'!E3),\"\",'2. Privacy information'!E3)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F3),\"\",'2. Privacy information'!F3)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G3),\"\",'2. Privacy information'!G3)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H3),\"\",'2. Privacy information'!H3)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I3),\"\",'2. Privacy information'!I3)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J3),\"\",'2. Privacy information'!J3)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.3","\tIdentify at least one lawful basis for sharing and provide this information in a way that people can understand. If more than one lawful basis applies, explain the circumstances and processing that each lawful basis applies to.",{"$f":"IF(ISBLANK('2. Privacy information'!E4),\"\",'2. Privacy information'!E4)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F4),\"\",'2. Privacy information'!F4)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G4),\"\",'2. Privacy information'!G4)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H4),\"\",'2. Privacy information'!H4)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I4),\"\",'2. Privacy information'!I4)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J4),\"\",'2. Privacy information'!J4)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.4","\tGive clear direction in data sharing privacy information on how people may exercise their rights with the organisations that you are sharing their information with.",{"$f":"IF(ISBLANK('2. Privacy information'!E5),\"\",'2. Privacy information'!E5)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F5),\"\",'2. Privacy information'!F5)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G5),\"\",'2. Privacy information'!G5)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H5),\"\",'2. Privacy information'!H5)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I5),\"\",'2. Privacy information'!I5)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J5),\"\",'2. Privacy information'!J5)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.5","\tInform people of any intention to transfer information to a third country or international organisation. This also includes any adequacy decision and appropriate safeguards, together with details on where to access them.",{"$f":"IF(ISBLANK('2. Privacy information'!E6),\"\",'2. Privacy information'!E6)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F6),\"\",'2. Privacy information'!F6)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G6),\"\",'2. Privacy information'!G6)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H6),\"\",'2. Privacy information'!H6)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I6),\"\",'2. Privacy information'!I6)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J6),\"\",'2. Privacy information'!J6)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.6","\tUpdate privacy information to inform people about any changes to data sharing activities, including the impact of those changes. ",{"$f":"IF(ISBLANK('2. Privacy information'!E7),\"\",'2. Privacy information'!E7)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F7),\"\",'2. Privacy information'!F7)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G7),\"\",'2. Privacy information'!G7)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H7),\"\",'2. Privacy information'!H7)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I7),\"\",'2. Privacy information'!I7)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J7),\"\",'2. Privacy information'!J7)","v":""}]
["Privacy information",2.1,"People are informed about their personal information being shared.","2.1.7","\tPut agreements in place, where parties are acting as joint controllers, which specify their duties to provide privacy information under articles 13 & 14 (article 26 of the UK GDPR).",{"$f":"IF(ISBLANK('2. Privacy information'!E8),\"\",'2. Privacy information'!E8)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!F8),\"\",'2. Privacy information'!F8)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!G8),\"\",'2. Privacy information'!G8)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!H8),\"\",'2. Privacy information'!H8)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!I8),\"\",'2. Privacy information'!I8)","v":""},{"$f":"IF(ISBLANK('2. Privacy information'!J8),\"\",'2. Privacy information'!J8)","v":""}]
["Assessing the legality, risks and benefits",3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.1","Complete an assessment of the legality of the sharing and document the outcome. ",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E2),\"\",'3. Legality risks benefits'!E2)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F2),\"\",'3. Legality risks benefits'!F2)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G2),\"\",'3. Legality risks benefits'!G2)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H2),\"\",'3. Legality risks benefits'!H2)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I2),\"\",'3. Legality risks benefits'!I2)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J2),\"\",'3. Legality risks benefits'!J2)","v":""}]
[{"$f":"A18","v":"Assessing the legality, risks and benefits"},{"$f":"B18","v":3.1},"There is a process to assess the legality of sharing and document any outcomes.","3.1.2","Ensure that the purpose of sharing is compatible with the purposes for which the information was originally collected (unless a valid exemption applies) (article 5(1)b or DPA18 section 36, or both).",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E3),\"\",'3. Legality risks benefits'!E3)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F3),\"\",'3. Legality risks benefits'!F3)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G3),\"\",'3. Legality risks benefits'!G3)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H3),\"\",'3. Legality risks benefits'!H3)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I3),\"\",'3. Legality risks benefits'!I3)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J3),\"\",'3. Legality risks benefits'!J3)","v":""}]
["Assessing the legality, risks and benefits",3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.3","Carry out a legitimate interest assessment (LIA), if you are relying on legitimate as the lawful basis for sharing.  ",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E4),\"\",'3. Legality risks benefits'!E4)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F4),\"\",'3. Legality risks benefits'!F4)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G4),\"\",'3. Legality risks benefits'!G4)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H4),\"\",'3. Legality risks benefits'!H4)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I4),\"\",'3. Legality risks benefits'!I4)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J4),\"\",'3. Legality risks benefits'!J4)","v":""}]
["Assessing the legality, risks and benefits",3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.4","Document the lawful basis (article 9,10 or DPA18 section 35, or both) and relevant conditions from schedule 1 or 9 of the DPA18, if the information you are sharing includes special category or criminal offence information under the UK GDPR.  ",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E5),\"\",'3. Legality risks benefits'!E5)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F5),\"\",'3. Legality risks benefits'!F5)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G5),\"\",'3. Legality risks benefits'!G5)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H5),\"\",'3. Legality risks benefits'!H5)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I5),\"\",'3. Legality risks benefits'!I5)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J5),\"\",'3. Legality risks benefits'!J5)","v":""}]
["Assessing the legality, risks and benefits",3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.5","Assess whether there is compelling reason to share it in line with the ICO’s data sharing code and the children’s code, prior to doing so.",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E6),\"\",'3. Legality risks benefits'!E6)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F6),\"\",'3. Legality risks benefits'!F6)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G6),\"\",'3. Legality risks benefits'!G6)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H6),\"\",'3. Legality risks benefits'!H6)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I6),\"\",'3. Legality risks benefits'!I6)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J6),\"\",'3. Legality risks benefits'!J6)","v":""}]
["Assessing the legality, risks and benefits",3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.6","For public authorities - Consider whether there is the legal power to share (outside the UK GDPR or DPA18) (ie a statutory obligation). Document the express or implied statutory legal power relied on.",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E7),\"\",'3. Legality risks benefits'!E7)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F7),\"\",'3. Legality risks benefits'!F7)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G7),\"\",'3. Legality risks benefits'!G7)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H7),\"\",'3. Legality risks benefits'!H7)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I7),\"\",'3. Legality risks benefits'!I7)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J7),\"\",'3. Legality risks benefits'!J7)","v":""}]
["Assessing the legality, risks and benefits",3.2,"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.1","Complete a DPIA to assess the risks before entering into any new data sharing activity. There is an obligation to do this when sharing is likely to result in a high risk to people’s rights and freedoms. ",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E8),\"\",'3. Legality risks benefits'!E8)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F8),\"\",'3. Legality risks benefits'!F8)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G8),\"\",'3. Legality risks benefits'!G8)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H8),\"\",'3. Legality risks benefits'!H8)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I8),\"\",'3. Legality risks benefits'!I8)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J8),\"\",'3. Legality risks benefits'!J8)","v":""}]
[{"$f":"A24","v":"Assessing the legality, risks and benefits"},3.2,"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.2","Always complete a DPIA if the data sharing involves children's personal information, in line with the data sharing code.",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E9),\"\",'3. Legality risks benefits'!E9)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F9),\"\",'3. Legality risks benefits'!F9)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G9),\"\",'3. Legality risks benefits'!G9)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H9),\"\",'3. Legality risks benefits'!H9)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I9),\"\",'3. Legality risks benefits'!I9)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J9),\"\",'3. Legality risks benefits'!J9)","v":""}]
["Assessing the legality, risks and benefits",3.2,"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.3","Seek input from all stakeholders to ensure that you properly consider risk factors when you are relying on a DPIA that is produced by other parties involved in the sharing.",{"$f":"IF(ISBLANK('3. Legality risks benefits'!E10),\"\",'3. Legality risks benefits'!E10)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!F10),\"\",'3. Legality risks benefits'!F10)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!G10),\"\",'3. Legality risks benefits'!G10)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!H10),\"\",'3. Legality risks benefits'!H10)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!I10),\"\",'3. Legality risks benefits'!I10)","v":""},{"$f":"IF(ISBLANK('3. Legality risks benefits'!J10),\"\",'3. Legality risks benefits'!J10)","v":""}]
["Data sharing agreement and logs",4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.1","\tEnsure data flow mapping analysis shows a clear differentiation between information that is shared with other organisations (C2C) and information that is processed by a data processor under instruction (C2P).",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E2),\"\",'4. Data sharing agreement&logs'!E2)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F2),\"\",'4. Data sharing agreement&logs'!F2)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G2),\"\",'4. Data sharing agreement&logs'!G2)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H2),\"\",'4. Data sharing agreement&logs'!H2)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I2),\"\",'4. Data sharing agreement&logs'!I2)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J2),\"\",'4. Data sharing agreement&logs'!J2)","v":""}]
[{"$f":"A27","v":"Data sharing agreement and logs"},{"$f":"B27","v":4.0999999999999996},"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.2","Have separate policies that clearly distinguish between the requirements for sharing information on a C2C or C2P basis.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E3),\"\",'4. Data sharing agreement&logs'!E3)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F3),\"\",'4. Data sharing agreement&logs'!F3)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G3),\"\",'4. Data sharing agreement&logs'!G3)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H3),\"\",'4. Data sharing agreement&logs'!H3)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I3),\"\",'4. Data sharing agreement&logs'!I3)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J3),\"\",'4. Data sharing agreement&logs'!J3)","v":""}]
["Data sharing agreement and logs",4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.3","\tEducate staff on the distinction between C2C and C2P data sharing.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E4),\"\",'4. Data sharing agreement&logs'!E4)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F4),\"\",'4. Data sharing agreement&logs'!F4)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G4),\"\",'4. Data sharing agreement&logs'!G4)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H4),\"\",'4. Data sharing agreement&logs'!H4)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I4),\"\",'4. Data sharing agreement&logs'!I4)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J4),\"\",'4. Data sharing agreement&logs'!J4)","v":""}]
["Data sharing agreement and logs",4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.4","Avoid using data sharing agreements that are drafted for use on a C2C basis, if you are instructing third-party processors to process information under instruction.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E5),\"\",'4. Data sharing agreement&logs'!E5)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F5),\"\",'4. Data sharing agreement&logs'!F5)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G5),\"\",'4. Data sharing agreement&logs'!G5)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H5),\"\",'4. Data sharing agreement&logs'!H5)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I5),\"\",'4. Data sharing agreement&logs'!I5)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J5),\"\",'4. Data sharing agreement&logs'!J5)","v":""}]
["Data sharing agreement and logs",4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.1","\tAgree written data sharing agreements with all the relevant parties and ensure senior management sign them off.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E6),\"\",'4. Data sharing agreement&logs'!E6)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F6),\"\",'4. Data sharing agreement&logs'!F6)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G6),\"\",'4. Data sharing agreement&logs'!G6)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H6),\"\",'4. Data sharing agreement&logs'!H6)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I6),\"\",'4. Data sharing agreement&logs'!I6)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J6),\"\",'4. Data sharing agreement&logs'!J6)","v":""}]
["Data sharing agreement and logs",{"$f":"B31","v":4.2},"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.2","Include the following details in data sharing agreements:\n-\t the parties' roles;\n-\t the purpose of the data sharing;\n-\t what is going to happen to the information at each stage; and\n-\t the standards set (with a high privacy default for children).",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E7),\"\",'4. Data sharing agreement&logs'!E7)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F7),\"\",'4. Data sharing agreement&logs'!F7)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G7),\"\",'4. Data sharing agreement&logs'!G7)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H7),\"\",'4. Data sharing agreement&logs'!H7)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I7),\"\",'4. Data sharing agreement&logs'!I7)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J7),\"\",'4. Data sharing agreement&logs'!J7)","v":""}]
["Data sharing agreement and logs",4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.3","\tImplement procedures and guidance covering day-to-day operations to support the agreements.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E8),\"\",'4. Data sharing agreement&logs'!E8)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F8),\"\",'4. Data sharing agreement&logs'!F8)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G8),\"\",'4. Data sharing agreement&logs'!G8)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H8),\"\",'4. Data sharing agreement&logs'!H8)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I8),\"\",'4. Data sharing agreement&logs'!I8)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J8),\"\",'4. Data sharing agreement&logs'!J8)","v":""}]
["Data sharing agreement and logs",4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.4","Where information is shared with parties outside the UK: \n-\t check whether the restricted transfer is covered by adequacy regulations or an article 49 exemption applies; and\n-\t if not, carry out a risk assessment and implement an article 46 transfer mechanism (along with any required additional steps or protections).",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E9),\"\",'4. Data sharing agreement&logs'!E9)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F9),\"\",'4. Data sharing agreement&logs'!F9)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G9),\"\",'4. Data sharing agreement&logs'!G9)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H9),\"\",'4. Data sharing agreement&logs'!H9)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I9),\"\",'4. Data sharing agreement&logs'!I9)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J9),\"\",'4. Data sharing agreement&logs'!J9)","v":""}]
["Data sharing agreement and logs",4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.5","\tEnsure agreements specify which controller is the contact point for people to exercise their rights, if parties are acting as joint controllers (article 26 of the UK GDPR and section 58 of the DPA18).",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E10),\"\",'4. Data sharing agreement&logs'!E10)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F10),\"\",'4. Data sharing agreement&logs'!F10)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G10),\"\",'4. Data sharing agreement&logs'!G10)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H10),\"\",'4. Data sharing agreement&logs'!H10)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I10),\"\",'4. Data sharing agreement&logs'!I10)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J10),\"\",'4. Data sharing agreement&logs'!J10)","v":""}]
["Data sharing agreement and logs",4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.6","For public authorities - Ensure the agreement covers responsibilities and procedures for responding to freedom of information requests and the need to include certain types of information in publication schemes.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E11),\"\",'4. Data sharing agreement&logs'!E11)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F11),\"\",'4. Data sharing agreement&logs'!F11)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G11),\"\",'4. Data sharing agreement&logs'!G11)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H11),\"\",'4. Data sharing agreement&logs'!H11)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I11),\"\",'4. Data sharing agreement&logs'!I11)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J11),\"\",'4. Data sharing agreement&logs'!J11)","v":""}]
["Data sharing agreement and logs",4.3,"There is a log or record of all data sharing agreements.","4.3.1","\tKeep a log of sharing agreements that details the nature of the sharing and the partners.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E12),\"\",'4. Data sharing agreement&logs'!E12)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F12),\"\",'4. Data sharing agreement&logs'!F12)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G12),\"\",'4. Data sharing agreement&logs'!G12)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H12),\"\",'4. Data sharing agreement&logs'!H12)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I12),\"\",'4. Data sharing agreement&logs'!I12)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J12),\"\",'4. Data sharing agreement&logs'!J12)","v":""}]
["Data sharing agreement and logs",{"$f":"B37","v":4.3},"There is a log or record of all data sharing agreements.","4.3.2","Include data sharing within the data mapping and data flow analysis. ",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E13),\"\",'4. Data sharing agreement&logs'!E13)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F13),\"\",'4. Data sharing agreement&logs'!F13)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G13),\"\",'4. Data sharing agreement&logs'!G13)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H13),\"\",'4. Data sharing agreement&logs'!H13)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I13),\"\",'4. Data sharing agreement&logs'!I13)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J13),\"\",'4. Data sharing agreement&logs'!J13)","v":""}]
["Data sharing agreement and logs",4.3,"There is a log or record of all data sharing agreements.","4.3.3","\tAssign information asset owners (IAOs) to oversee any information sharing within their information assets.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E14),\"\",'4. Data sharing agreement&logs'!E14)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F14),\"\",'4. Data sharing agreement&logs'!F14)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G14),\"\",'4. Data sharing agreement&logs'!G14)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H14),\"\",'4. Data sharing agreement&logs'!H14)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I14),\"\",'4. Data sharing agreement&logs'!I14)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J14),\"\",'4. Data sharing agreement&logs'!J14)","v":""}]
["Data sharing agreement and logs",4.3,"There is a log or record of all data sharing agreements.","4.3.4","Include data sharing information on the record of processing activities (ROPA). Include categories of recipients that personal information will be disclosed to, including recipients in third countries or international organisations.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E15),\"\",'4. Data sharing agreement&logs'!E15)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F15),\"\",'4. Data sharing agreement&logs'!F15)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G15),\"\",'4. Data sharing agreement&logs'!G15)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H15),\"\",'4. Data sharing agreement&logs'!H15)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I15),\"\",'4. Data sharing agreement&logs'!I15)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J15),\"\",'4. Data sharing agreement&logs'!J15)","v":""}]
["Data sharing agreement and logs",4.3,"There is a log or record of all data sharing agreements.","4.3.5","Maintain a record of what was shared and when, so you can: \n- \tact on a person’s request to exercise their rights under UK GDPR; or \n- \tknow whether they are affected if there is a data breach",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E16),\"\",'4. Data sharing agreement&logs'!E16)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F16),\"\",'4. Data sharing agreement&logs'!F16)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G16),\"\",'4. Data sharing agreement&logs'!G16)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H16),\"\",'4. Data sharing agreement&logs'!H16)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I16),\"\",'4. Data sharing agreement&logs'!I16)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J16),\"\",'4. Data sharing agreement&logs'!J16)","v":""}]
["Data sharing agreement and logs",4.3,"There is a log or record of all data sharing agreements.","4.3.6","\tPut in place appropriate information tracking, tracing and labelling procedures to understand what information has gone where and when. In particular, if there are large information transfers or information is shared to enable artificial intelligence services.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E17),\"\",'4. Data sharing agreement&logs'!E17)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F17),\"\",'4. Data sharing agreement&logs'!F17)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G17),\"\",'4. Data sharing agreement&logs'!G17)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H17),\"\",'4. Data sharing agreement&logs'!H17)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I17),\"\",'4. Data sharing agreement&logs'!I17)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J17),\"\",'4. Data sharing agreement&logs'!J17)","v":""}]
["Data sharing agreement and logs",4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.1","\tCreate a review process to regularly examine whether data sharing under your agreements continues to be appropriate.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E18),\"\",'4. Data sharing agreement&logs'!E18)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F18),\"\",'4. Data sharing agreement&logs'!F18)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G18),\"\",'4. Data sharing agreement&logs'!G18)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H18),\"\",'4. Data sharing agreement&logs'!H18)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I18),\"\",'4. Data sharing agreement&logs'!I18)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J18),\"\",'4. Data sharing agreement&logs'!J18)","v":""}]
[{"$f":"A43","v":"Data sharing agreement and logs"},4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.2","\tEnsure partner organisations are removed from or added to agreements, when required.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E19),\"\",'4. Data sharing agreement&logs'!E19)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F19),\"\",'4. Data sharing agreement&logs'!F19)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G19),\"\",'4. Data sharing agreement&logs'!G19)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H19),\"\",'4. Data sharing agreement&logs'!H19)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I19),\"\",'4. Data sharing agreement&logs'!I19)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J19),\"\",'4. Data sharing agreement&logs'!J19)","v":""}]
["Data sharing agreement and logs",4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.3","Implement processes to review agreements following: \n- \ta change in circumstances for sharing partners;\n- \ta change in the reason for the data sharing; \n- \ta significant complaint; or \n- \ta security breach.",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E20),\"\",'4. Data sharing agreement&logs'!E20)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F20),\"\",'4. Data sharing agreement&logs'!F20)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G20),\"\",'4. Data sharing agreement&logs'!G20)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H20),\"\",'4. Data sharing agreement&logs'!H20)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I20),\"\",'4. Data sharing agreement&logs'!I20)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J20),\"\",'4. Data sharing agreement&logs'!J20)","v":""}]
["Data sharing agreement and logs",4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.4","\tRegularly include the outcomes of the reviews on the agenda for the information governance board (or equivalent).",{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!E21),\"\",'4. Data sharing agreement&logs'!E21)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!F21),\"\",'4. Data sharing agreement&logs'!F21)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!G21),\"\",'4. Data sharing agreement&logs'!G21)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!H21),\"\",'4. Data sharing agreement&logs'!H21)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!I21),\"\",'4. Data sharing agreement&logs'!I21)","v":""},{"$f":"IF(ISBLANK('4. Data sharing agreement&logs'!J21),\"\",'4. Data sharing agreement&logs'!J21)","v":""}]
["Information accuracy, quality and retention",5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.1","\tMinimise shared personal information to agreed data sets or redact and clearly distinguish between fact and opinion.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E2),\"\",'5. Accuracy quality retention'!E2)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F2),\"\",'5. Accuracy quality retention'!F2)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G2),\"\",'5. Accuracy quality retention'!G2)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H2),\"\",'5. Accuracy quality retention'!H2)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I2),\"\",'5. Accuracy quality retention'!I2)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J2),\"\",'5. Accuracy quality retention'!J2)","v":""}]
[{"$f":"A47","v":"Information accuracy, quality and retention"},{"$f":"B47","v":5.0999999999999996},"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.2","\tCreate a process to assess whether the information shared is as complete as possible (within the bounds of what you have defined and agreed to share).",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E3),\"\",'5. Accuracy quality retention'!E3)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F3),\"\",'5. Accuracy quality retention'!F3)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G3),\"\",'5. Accuracy quality retention'!G3)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H3),\"\",'5. Accuracy quality retention'!H3)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I3),\"\",'5. Accuracy quality retention'!I3)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J3),\"\",'5. Accuracy quality retention'!J3)","v":""}]
["Information accuracy, quality and retention",5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.3","\tSeek technical advice before sharing information, if different systems are involved.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E4),\"\",'5. Accuracy quality retention'!E4)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F4),\"\",'5. Accuracy quality retention'!F4)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G4),\"\",'5. Accuracy quality retention'!G4)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H4),\"\",'5. Accuracy quality retention'!H4)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I4),\"\",'5. Accuracy quality retention'!I4)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J4),\"\",'5. Accuracy quality retention'!J4)","v":""}]
["Information accuracy, quality and retention",5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.4","\tRecord information in the same format, abiding by open standards when applicable.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E5),\"\",'5. Accuracy quality retention'!E5)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F5),\"\",'5. Accuracy quality retention'!F5)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G5),\"\",'5. Accuracy quality retention'!G5)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H5),\"\",'5. Accuracy quality retention'!H5)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I5),\"\",'5. Accuracy quality retention'!I5)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J5),\"\",'5. Accuracy quality retention'!J5)","v":""}]
["Information accuracy, quality and retention",5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.5","\tInform recipients when you amend or update shared information.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E6),\"\",'5. Accuracy quality retention'!E6)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F6),\"\",'5. Accuracy quality retention'!F6)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G6),\"\",'5. Accuracy quality retention'!G6)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H6),\"\",'5. Accuracy quality retention'!H6)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I6),\"\",'5. Accuracy quality retention'!I6)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J6),\"\",'5. Accuracy quality retention'!J6)","v":""}]
["Information accuracy, quality and retention",5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.6","\tImplement regular quality checks or verification processes to assess whether shared information is accurate and up-to-date. This applies to all sharing partners.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E7),\"\",'5. Accuracy quality retention'!E7)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F7),\"\",'5. Accuracy quality retention'!F7)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G7),\"\",'5. Accuracy quality retention'!G7)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H7),\"\",'5. Accuracy quality retention'!H7)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I7),\"\",'5. Accuracy quality retention'!I7)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J7),\"\",'5. Accuracy quality retention'!J7)","v":""}]
["Information accuracy, quality and retention",5.2,"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.1","\tEnsure common retention and disposal arrangements are agreed between all parties prior to sharing information. ",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E8),\"\",'5. Accuracy quality retention'!E8)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F8),\"\",'5. Accuracy quality retention'!F8)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G8),\"\",'5. Accuracy quality retention'!G8)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H8),\"\",'5. Accuracy quality retention'!H8)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I8),\"\",'5. Accuracy quality retention'!I8)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J8),\"\",'5. Accuracy quality retention'!J8)","v":""}]
[{"$f":"A53","v":"Information accuracy, quality and retention"},5.2,"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.2","\tDocument the agreed retention and disposal arrangements within data sharing agreements.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E9),\"\",'5. Accuracy quality retention'!E9)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F9),\"\",'5. Accuracy quality retention'!F9)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G9),\"\",'5. Accuracy quality retention'!G9)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H9),\"\",'5. Accuracy quality retention'!H9)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I9),\"\",'5. Accuracy quality retention'!I9)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J9),\"\",'5. Accuracy quality retention'!J9)","v":""}]
["Information accuracy, quality and retention",5.2,"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.3","Seek guarantees that recipients will delete, destroy or return shared information:\n- \tonce the purpose is served; \n- \twhen a relevant retention period expires; or \n- \tin the event of a breach, if appropriate.",{"$f":"IF(ISBLANK('5. Accuracy quality retention'!E10),\"\",'5. Accuracy quality retention'!E10)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!F10),\"\",'5. Accuracy quality retention'!F10)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!G10),\"\",'5. Accuracy quality retention'!G10)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!H10),\"\",'5. Accuracy quality retention'!H10)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!I10),\"\",'5. Accuracy quality retention'!I10)","v":""},{"$f":"IF(ISBLANK('5. Accuracy quality retention'!J10),\"\",'5. Accuracy quality retention'!J10)","v":""}]
["Information security",6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.1","\tAnalyse the risks to determine the appropriate security measures for information that is transmitted or received. For example, by assessing the nature and sensitivity of the shared information. Also assess the confidentiality of the shared information, or any protective marking scheme. For example, encrypt 'confidential' personal information.",{"$f":"IF(ISBLANK('6. Info security'!E2),\"\",'6. Info security'!E2)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F2),\"\",'6. Info security'!F2)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G2),\"\",'6. Info security'!G2)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H2),\"\",'6. Info security'!H2)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I2),\"\",'6. Info security'!I2)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J2),\"\",'6. Info security'!J2)","v":""}]
[{"$f":"A56","v":"Information security"},{"$f":"B56","v":6.1},"There are appropriate security measures in place to protect the information received and transmitted.","6.1.2","\tSet out how information will be shared (and the agreed security standards) within written agreements and supporting procedures. For example, by recorded post, encrypted email or secure file transfer protocol (SFTP).",{"$f":"IF(ISBLANK('6. Info security'!E3),\"\",'6. Info security'!E3)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F3),\"\",'6. Info security'!F3)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G3),\"\",'6. Info security'!G3)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H3),\"\",'6. Info security'!H3)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I3),\"\",'6. Info security'!I3)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J3),\"\",'6. Info security'!J3)","v":""}]
["Information security",6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.3","\tActively obtain regular assurance on the security of any intermediate platform used for sharing information that is not under your direct monitoring and control.",{"$f":"IF(ISBLANK('6. Info security'!E4),\"\",'6. Info security'!E4)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F4),\"\",'6. Info security'!F4)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G4),\"\",'6. Info security'!G4)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H4),\"\",'6. Info security'!H4)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I4),\"\",'6. Info security'!I4)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J4),\"\",'6. Info security'!J4)","v":""}]
["Information security",6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.4","\tEstablish a back-up process to ensure you can restore access to information in the event of a breach. ",{"$f":"IF(ISBLANK('6. Info security'!E5),\"\",'6. Info security'!E5)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F5),\"\",'6. Info security'!F5)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G5),\"\",'6. Info security'!G5)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H5),\"\",'6. Info security'!H5)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I5),\"\",'6. Info security'!I5)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J5),\"\",'6. Info security'!J5)","v":""}]
["Information security",6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.5","\tReview and re-confirm security measures and assurances between sharing partners on a regular basis or when any of the partners make changes to its IT systems or security protocols.",{"$f":"IF(ISBLANK('6. Info security'!E6),\"\",'6. Info security'!E6)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F6),\"\",'6. Info security'!F6)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G6),\"\",'6. Info security'!G6)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H6),\"\",'6. Info security'!H6)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I6),\"\",'6. Info security'!I6)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J6),\"\",'6. Info security'!J6)","v":""}]
["Information security",6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.6","\tDocument and implement overarching information security policies and procedures across the organisation.",{"$f":"IF(ISBLANK('6. Info security'!E7),\"\",'6. Info security'!E7)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F7),\"\",'6. Info security'!F7)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G7),\"\",'6. Info security'!G7)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H7),\"\",'6. Info security'!H7)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I7),\"\",'6. Info security'!I7)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J7),\"\",'6. Info security'!J7)","v":""}]
["Information security",6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.1","\tEnsure sharing partners provide documented access control policies.",{"$f":"IF(ISBLANK('6. Info security'!E8),\"\",'6. Info security'!E8)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F8),\"\",'6. Info security'!F8)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G8),\"\",'6. Info security'!G8)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H8),\"\",'6. Info security'!H8)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I8),\"\",'6. Info security'!I8)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J8),\"\",'6. Info security'!J8)","v":""}]
["Information security",{"$f":"B62","v":6.2},"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.2","\tObtain assurances that access control is formally implemented by all sharing partners.",{"$f":"IF(ISBLANK('6. Info security'!E9),\"\",'6. Info security'!E9)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F9),\"\",'6. Info security'!F9)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G9),\"\",'6. Info security'!G9)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H9),\"\",'6. Info security'!H9)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I9),\"\",'6. Info security'!I9)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J9),\"\",'6. Info security'!J9)","v":""}]
["Information security",6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.3","\tObtain assurances from sharing partners that only agreed points of contact or specific categories of employee have access to the shared information.",{"$f":"IF(ISBLANK('6. Info security'!E10),\"\",'6. Info security'!E10)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F10),\"\",'6. Info security'!F10)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G10),\"\",'6. Info security'!G10)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H10),\"\",'6. Info security'!H10)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I10),\"\",'6. Info security'!I10)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J10),\"\",'6. Info security'!J10)","v":""}]
["Information security",6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.4","\tRegularly test, assess and evaluate the effectiveness of the access control measures that you have implemented.",{"$f":"IF(ISBLANK('6. Info security'!E11),\"\",'6. Info security'!E11)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F11),\"\",'6. Info security'!F11)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G11),\"\",'6. Info security'!G11)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H11),\"\",'6. Info security'!H11)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I11),\"\",'6. Info security'!I11)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J11),\"\",'6. Info security'!J11)","v":""}]
["Information security",6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.1","\tEnsure sharing partners provide documented incident management procedures.",{"$f":"IF(ISBLANK('6. Info security'!E12),\"\",'6. Info security'!E12)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F12),\"\",'6. Info security'!F12)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G12),\"\",'6. Info security'!G12)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H12),\"\",'6. Info security'!H12)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I12),\"\",'6. Info security'!I12)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J12),\"\",'6. Info security'!J12)","v":""}]
[{"$f":"A66","v":"Information security"},6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.2","\tObtain assurances that formal incident management procedures are implemented and regularly tested.",{"$f":"IF(ISBLANK('6. Info security'!E13),\"\",'6. Info security'!E13)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F13),\"\",'6. Info security'!F13)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G13),\"\",'6. Info security'!G13)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H13),\"\",'6. Info security'!H13)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I13),\"\",'6. Info security'!I13)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J13),\"\",'6. Info security'!J13)","v":""}]
["Information security",6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.3","\tEnsure there are procedures in place to promptly report, investigate, and resolve security incidents.",{"$f":"IF(ISBLANK('6. Info security'!E14),\"\",'6. Info security'!E14)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F14),\"\",'6. Info security'!F14)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G14),\"\",'6. Info security'!G14)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H14),\"\",'6. Info security'!H14)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I14),\"\",'6. Info security'!I14)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J14),\"\",'6. Info security'!J14)","v":""}]
["Information security",6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.4","Establish key points of contacts with all sharing partners so that incidents can be reported quickly and investigated.",{"$f":"IF(ISBLANK('6. Info security'!E15),\"\",'6. Info security'!E15)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F15),\"\",'6. Info security'!F15)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G15),\"\",'6. Info security'!G15)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H15),\"\",'6. Info security'!H15)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I15),\"\",'6. Info security'!I15)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J15),\"\",'6. Info security'!J15)","v":""}]
["Information security",6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.5","\tKeep a log of actual and potential security incidents relating to data sharing.",{"$f":"IF(ISBLANK('6. Info security'!E16),\"\",'6. Info security'!E16)","v":""},{"$f":"IF(ISBLANK('6. Info security'!F16),\"\",'6. Info security'!F16)","v":""},{"$f":"IF(ISBLANK('6. Info security'!G16),\"\",'6. Info security'!G16)","v":""},{"$f":"IF(ISBLANK('6. Info security'!H16),\"\",'6. Info security'!H16)","v":""},{"$f":"IF(ISBLANK('6. Info security'!I16),\"\",'6. Info security'!I16)","v":""},{"$f":"IF(ISBLANK('6. Info security'!J16),\"\",'6. Info security'!J16)","v":""}]
["Disclosures",7.1,"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.1","\tImplement a policy or procedure for responding to ad hoc third-party requests for personal information and communicate it to staff.",{"$f":"IF(ISBLANK('7. Disclosures'!E2),\"\",'7. Disclosures'!E2)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F2),\"\",'7. Disclosures'!F2)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G2),\"\",'7. Disclosures'!G2)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H2),\"\",'7. Disclosures'!H2)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I2),\"\",'7. Disclosures'!I2)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J2),\"\",'7. Disclosures'!J2)","v":""}]
[{"$f":"A71","v":"Disclosures"},{"$f":"B71","v":7.1},"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.2","\tKeep a record on the person's file, spreadsheet or monitoring documents indicating when there is a verbal or written disclosure to third parties.",{"$f":"IF(ISBLANK('7. Disclosures'!E3),\"\",'7. Disclosures'!E3)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F3),\"\",'7. Disclosures'!F3)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G3),\"\",'7. Disclosures'!G3)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H3),\"\",'7. Disclosures'!H3)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I3),\"\",'7. Disclosures'!I3)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J3),\"\",'7. Disclosures'!J3)","v":""}]
["Disclosures",7.1,"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.3","\tConsider whether you should put a data sharing agreement in place with the third party, if their ad hoc requests become more frequent.",{"$f":"IF(ISBLANK('7. Disclosures'!E4),\"\",'7. Disclosures'!E4)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F4),\"\",'7. Disclosures'!F4)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G4),\"\",'7. Disclosures'!G4)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H4),\"\",'7. Disclosures'!H4)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I4),\"\",'7. Disclosures'!I4)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J4),\"\",'7. Disclosures'!J4)","v":""}]
["Disclosures",7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.1","\tKeep a record on the person's file, in a spreadsheet or monitoring documents indicating verbal or written disclosures to third parties.",{"$f":"IF(ISBLANK('7. Disclosures'!E5),\"\",'7. Disclosures'!E5)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F5),\"\",'7. Disclosures'!F5)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G5),\"\",'7. Disclosures'!G5)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H5),\"\",'7. Disclosures'!H5)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I5),\"\",'7. Disclosures'!I5)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J5),\"\",'7. Disclosures'!J5)","v":""}]
[{"$f":"A74","v":"Disclosures"},7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.2","\tKeep a record of the steps taken to identify the nature of the disclosure, the requester and the reason for it.",{"$f":"IF(ISBLANK('7. Disclosures'!E6),\"\",'7. Disclosures'!E6)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F6),\"\",'7. Disclosures'!F6)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G6),\"\",'7. Disclosures'!G6)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H6),\"\",'7. Disclosures'!H6)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I6),\"\",'7. Disclosures'!I6)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J6),\"\",'7. Disclosures'!J6)","v":""}]
["Disclosures",7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.3","\tKeep a record of all disclosure approvals, where appropriate",{"$f":"IF(ISBLANK('7. Disclosures'!E7),\"\",'7. Disclosures'!E7)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F7),\"\",'7. Disclosures'!F7)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G7),\"\",'7. Disclosures'!G7)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H7),\"\",'7. Disclosures'!H7)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I7),\"\",'7. Disclosures'!I7)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J7),\"\",'7. Disclosures'!J7)","v":""}]
["Disclosures",7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.4","\tConduct quality assurance on verbal and written disclosures to provide assurances that staff are following procedures  and actioning disclosures lawfully.",{"$f":"IF(ISBLANK('7. Disclosures'!E8),\"\",'7. Disclosures'!E8)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F8),\"\",'7. Disclosures'!F8)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G8),\"\",'7. Disclosures'!G8)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H8),\"\",'7. Disclosures'!H8)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I8),\"\",'7. Disclosures'!I8)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J8),\"\",'7. Disclosures'!J8)","v":""}]
["Disclosures",7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.5","\tLog all inappropriate disclosures as a personal data breach and take appropriate action. ",{"$f":"IF(ISBLANK('7. Disclosures'!E9),\"\",'7. Disclosures'!E9)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!F9),\"\",'7. Disclosures'!F9)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!G9),\"\",'7. Disclosures'!G9)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!H9),\"\",'7. Disclosures'!H9)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!I9),\"\",'7. Disclosures'!I9)","v":""},{"$f":"IF(ISBLANK('7. Disclosures'!J9),\"\",'7. Disclosures'!J9)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.1","\tEnsure written data sharing agreements are detailed enough to meet the requirements of the data sharing code.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E2),\"\",'8. Bulk transfers personal info'!E2)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F2),\"\",'8. Bulk transfers personal info'!F2)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G2),\"\",'8. Bulk transfers personal info'!G2)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H2),\"\",'8. Bulk transfers personal info'!H2)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I2),\"\",'8. Bulk transfers personal info'!I2)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J2),\"\",'8. Bulk transfers personal info'!J2)","v":""}]
[{"$f":"A79","v":"Bulk transfers of personal info in databases or lists"},8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.2","\tEnsure data sharing agreements are signed off by senior management.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E3),\"\",'8. Bulk transfers personal info'!E3)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F3),\"\",'8. Bulk transfers personal info'!F3)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G3),\"\",'8. Bulk transfers personal info'!G3)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H3),\"\",'8. Bulk transfers personal info'!H3)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I3),\"\",'8. Bulk transfers personal info'!I3)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J3),\"\",'8. Bulk transfers personal info'!J3)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.3","\tTrain teams involved in configuring or generating bulk personal information transfers appropriately. ",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E4),\"\",'8. Bulk transfers personal info'!E4)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F4),\"\",'8. Bulk transfers personal info'!F4)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G4),\"\",'8. Bulk transfers personal info'!G4)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H4),\"\",'8. Bulk transfers personal info'!H4)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I4),\"\",'8. Bulk transfers personal info'!I4)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J4),\"\",'8. Bulk transfers personal info'!J4)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.4","\tEnsure these teams clearly understand the authorisation processes, prior to releasing any information or adjusting existing data sets.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E5),\"\",'8. Bulk transfers personal info'!E5)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F5),\"\",'8. Bulk transfers personal info'!F5)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G5),\"\",'8. Bulk transfers personal info'!G5)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H5),\"\",'8. Bulk transfers personal info'!H5)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I5),\"\",'8. Bulk transfers personal info'!I5)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J5),\"\",'8. Bulk transfers personal info'!J5)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.5","\tDevelop an approval process for adjustments to existing data sets before changes are actioned. Evidence the change management process. ",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E6),\"\",'8. Bulk transfers personal info'!E6)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F6),\"\",'8. Bulk transfers personal info'!F6)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G6),\"\",'8. Bulk transfers personal info'!G6)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H6),\"\",'8. Bulk transfers personal info'!H6)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I6),\"\",'8. Bulk transfers personal info'!I6)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J6),\"\",'8. Bulk transfers personal info'!J6)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.6","\tClearly define the specific roles that have the authority to configure or generate data sets for release to data sharing partners.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E7),\"\",'8. Bulk transfers personal info'!E7)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F7),\"\",'8. Bulk transfers personal info'!F7)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G7),\"\",'8. Bulk transfers personal info'!G7)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H7),\"\",'8. Bulk transfers personal info'!H7)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I7),\"\",'8. Bulk transfers personal info'!I7)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J7),\"\",'8. Bulk transfers personal info'!J7)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.7","\tClearly define the specific roles that have the authority to release information to sharing partners. ",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E8),\"\",'8. Bulk transfers personal info'!E8)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F8),\"\",'8. Bulk transfers personal info'!F8)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G8),\"\",'8. Bulk transfers personal info'!G8)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H8),\"\",'8. Bulk transfers personal info'!H8)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I8),\"\",'8. Bulk transfers personal info'!I8)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J8),\"\",'8. Bulk transfers personal info'!J8)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.8","Tell sharing partners: \n- \tthe source of the information; \n- \tthe lawful basis you obtained it on;\n- \thow you initially collected it; and \n- \twhat you told people at the time about the purposes you are processing it for.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E9),\"\",'8. Bulk transfers personal info'!E9)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F9),\"\",'8. Bulk transfers personal info'!F9)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G9),\"\",'8. Bulk transfers personal info'!G9)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H9),\"\",'8. Bulk transfers personal info'!H9)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I9),\"\",'8. Bulk transfers personal info'!I9)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J9),\"\",'8. Bulk transfers personal info'!J9)","v":""}]
["Bulk transfers of personal info in databases or lists",8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.9","\tImplement processes to monitor platforms and other data sharing mechanisms and ensure they are functioning as they should.",{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!E10),\"\",'8. Bulk transfers personal info'!E10)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!F10),\"\",'8. Bulk transfers personal info'!F10)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!G10),\"\",'8. Bulk transfers personal info'!G10)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!H10),\"\",'8. Bulk transfers personal info'!H10)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!I10),\"\",'8. Bulk transfers personal info'!I10)","v":""},{"$f":"IF(ISBLANK('8. Bulk transfers personal info'!J10),\"\",'8. Bulk transfers personal info'!J10)","v":""}]
["Information sharing in an urgent situation or emergency",9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.1","\tConsider and document the types of information you are likely to need to share in advance and where this is held.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E2),\"\",'9. Urgent emergency info share'!E2)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F2),\"\",'9. Urgent emergency info share'!F2)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G2),\"\",'9. Urgent emergency info share'!G2)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H2),\"\",'9. Urgent emergency info share'!H2)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I2),\"\",'9. Urgent emergency info share'!I2)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J2),\"\",'9. Urgent emergency info share'!J2)","v":""}]
[{"$f":"A88","v":"Information sharing in an urgent situation or emergency"},9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.2","\tDocument clear plans that outline when and how you share information in an emergency and who has authority to make these decisions.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E3),\"\",'9. Urgent emergency info share'!E3)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F3),\"\",'9. Urgent emergency info share'!F3)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G3),\"\",'9. Urgent emergency info share'!G3)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H3),\"\",'9. Urgent emergency info share'!H3)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I3),\"\",'9. Urgent emergency info share'!I3)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J3),\"\",'9. Urgent emergency info share'!J3)","v":""}]
["Information sharing in an urgent situation or emergency",9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.3","\tInclude a risk assessment as part of any pre-existing DPIA, and refer to business continuity and disaster recovery plans.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E4),\"\",'9. Urgent emergency info share'!E4)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F4),\"\",'9. Urgent emergency info share'!F4)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G4),\"\",'9. Urgent emergency info share'!G4)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H4),\"\",'9. Urgent emergency info share'!H4)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I4),\"\",'9. Urgent emergency info share'!I4)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J4),\"\",'9. Urgent emergency info share'!J4)","v":""}]
["Information sharing in an urgent situation or emergency",9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.4","\tConsider and document all security measures that you will take if you are required to share in an urgent situation or emergency.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E5),\"\",'9. Urgent emergency info share'!E5)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F5),\"\",'9. Urgent emergency info share'!F5)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G5),\"\",'9. Urgent emergency info share'!G5)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H5),\"\",'9. Urgent emergency info share'!H5)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I5),\"\",'9. Urgent emergency info share'!I5)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J5),\"\",'9. Urgent emergency info share'!J5)","v":""}]
["Information sharing in an urgent situation or emergency",9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.5","\tPut data sharing agreements in place for this type of emergency sharing in advance, where you know the likely sharing partners.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E6),\"\",'9. Urgent emergency info share'!E6)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F6),\"\",'9. Urgent emergency info share'!F6)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G6),\"\",'9. Urgent emergency info share'!G6)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H6),\"\",'9. Urgent emergency info share'!H6)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I6),\"\",'9. Urgent emergency info share'!I6)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J6),\"\",'9. Urgent emergency info share'!J6)","v":""}]
["Information sharing in an urgent situation or emergency",9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.6","\tTrain staff on emergency plans and how to share information in these situations.",{"$f":"IF(ISBLANK('9. Urgent emergency info share'!E7),\"\",'9. Urgent emergency info share'!E7)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!F7),\"\",'9. Urgent emergency info share'!F7)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!G7),\"\",'9. Urgent emergency info share'!G7)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!H7),\"\",'9. Urgent emergency info share'!H7)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!I7),\"\",'9. Urgent emergency info share'!I7)","v":""},{"$f":"IF(ISBLANK('9. Urgent emergency info share'!J7),\"\",'9. Urgent emergency info share'!J7)","v":""}]

{"sheet":"Tables & graphs","index":3,"n_rows":27,"n_cols":11,"rows_kept":27,"cut":false,"hidden":true,"merged":[]}
[null,"1. Informed decision making","2. Privacy information","3. Assessing the legality risks and benefits","4. Data sharing agreements & logs","5. Accuracy quality & retention","6. Information security","7. Disclosures","8. Bulk transfers","9. Urgent emergency sharing","Total"]
["Fully meeting our expectation",{"$f":"COUNTIF('1. Informed decision making'!E:E,A2)","v":0},{"$f":"COUNTIF('2. Privacy information'!E:E,A2)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!E:E,A2)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!E:E,A2)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!E:E,A2)","v":0},{"$f":"COUNTIF('6. Info security'!E:E,A2)","v":0},{"$f":"COUNTIF('7. Disclosures'!E:E,A2)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!E:E,A2)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!E:E,A2)","v":0},{"$f":"SUM(B2:J2)","v":0}]
["Partially meeting our expectation",{"$f":"COUNTIF('1. Informed decision making'!E:E,A3)","v":0},{"$f":"COUNTIF('2. Privacy information'!E:E,A3)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!E:E,A3)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!E:E,A3)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!E:E,A3)","v":0},{"$f":"COUNTIF('6. Info security'!E:E,A3)","v":0},{"$f":"COUNTIF('7. Disclosures'!E:E,A3)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!E:E,A3)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!E:E,A3)","v":0},{"$f":"SUM(B3:J3)","v":0}]
["Not meeting our expectation",{"$f":"COUNTIF('1. Informed decision making'!E:E,A4)","v":0},{"$f":"COUNTIF('2. Privacy information'!E:E,A4)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!E:E,A4)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!E:E,A4)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!E:E,A4)","v":0},{"$f":"COUNTIF('6. Info security'!E:E,A4)","v":0},{"$f":"COUNTIF('7. Disclosures'!E:E,A4)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!E:E,A4)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!E:E,A4)","v":0},{"$f":"SUM(B4:J4)","v":0}]
["Not Applicable",{"$f":"COUNTIF('1. Informed decision making'!E:E,A5)","v":0},{"$f":"COUNTIF('2. Privacy information'!E:E,A5)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!E:E,A5)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!E:E,A5)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!E:E,A5)","v":0},{"$f":"COUNTIF('6. Info security'!E:E,A5)","v":0},{"$f":"COUNTIF('7. Disclosures'!E:E,A5)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!E:E,A5)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!E:E,A5)","v":0},{"$f":"SUM(B5:J5)","v":0}]
["Blank",{"$f":"COUNTBLANK('1. Informed decision making'!E2:E9)","v":8},{"$f":"COUNTBLANK('2. Privacy information'!E2:E8)","v":7},{"$f":"COUNTBLANK('3. Legality risks benefits'!E2:E10)","v":9},{"$f":"COUNTBLANK('4. Data sharing agreement&logs'!E2:E21)","v":20},{"$f":"COUNTBLANK('5. Accuracy quality retention'!E2:E10)","v":9},{"$f":"COUNTBLANK('6. Info security'!E2:E16)","v":15},{"$f":"COUNTBLANK('7. Disclosures'!E2:E9)","v":8},{"$f":"COUNTBLANK('8. Bulk transfers personal info'!E2:E10)","v":9},{"$f":"COUNTBLANK('9. Urgent emergency info share'!E2:E7)","v":6},{"$f":"SUM(B6:J6)","v":91}]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[]
[null,"1. Informed decision making","2. Privacy information","3. Assessing the legality risks and benefits","4. Data sharing agreements & logs","5. Accuracy quality & retention","6. Information security","7. Disclosures","8. Bulk transfers","9. Urgent emergency sharing","Total"]
["Not started",{"$f":"COUNTIF('1. Informed decision making'!I:I,A18)","v":0},{"$f":"COUNTIF('2. Privacy information'!I:I,A18)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!I:I,A18)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!I:I,A18)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!I:I,A18)","v":0},{"$f":"COUNTIF('6. Info security'!I:I,A18)","v":0},{"$f":"COUNTIF('7. Disclosures'!I:I,A18)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!I:I,A18)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!I:I,A18)","v":0},{"$f":"SUM(B18:J18)","v":0}]
["Action rejected",{"$f":"COUNTIF('1. Informed decision making'!I:I,A19)","v":0},{"$f":"COUNTIF('2. Privacy information'!I:I,A19)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!I:I,A19)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!I:I,A19)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!I:I,A19)","v":0},{"$f":"COUNTIF('6. Info security'!I:I,A19)","v":0},{"$f":"COUNTIF('7. Disclosures'!I:I,A19)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!I:I,A19)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!I:I,A19)","v":0},0]
["On track",{"$f":"COUNTIF('1. Informed decision making'!I:I,A20)","v":0},{"$f":"COUNTIF('2. Privacy information'!I:I,A20)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!I:I,A20)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!I:I,A20)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!I:I,A20)","v":0},{"$f":"COUNTIF('6. Info security'!I:I,A20)","v":0},{"$f":"COUNTIF('7. Disclosures'!I:I,A20)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!I:I,A20)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!I:I,A20)","v":0},0]
["Overdue",{"$f":"COUNTIF('1. Informed decision making'!I:I,A21)","v":0},{"$f":"COUNTIF('2. Privacy information'!I:I,A21)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!I:I,A21)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!I:I,A21)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!I:I,A21)","v":0},{"$f":"COUNTIF('6. Info security'!I:I,A21)","v":0},{"$f":"COUNTIF('7. Disclosures'!I:I,A21)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!I:I,A21)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!I:I,A21)","v":0},0]
["Completed",{"$f":"COUNTIF('1. Informed decision making'!I:I,A22)","v":0},{"$f":"COUNTIF('2. Privacy information'!I:I,A22)","v":0},{"$f":"COUNTIF('3. Legality risks benefits'!I:I,A22)","v":0},{"$f":"COUNTIF('4. Data sharing agreement&logs'!I:I,A22)","v":0},{"$f":"COUNTIF('5. Accuracy quality retention'!I:I,A22)","v":0},{"$f":"COUNTIF('6. Info security'!I:I,A22)","v":0},{"$f":"COUNTIF('7. Disclosures'!I:I,A22)","v":0},{"$f":"COUNTIF('8. Bulk transfers personal info'!I:I,A22)","v":0},{"$f":"COUNTIF('9. Urgent emergency info share'!I:I,A22)","v":0},0]
["Blank",{"$f":"COUNTBLANK('1. Informed decision making'!I2:I9)","v":8},{"$f":"COUNTBLANK('2. Privacy information'!I2:I8)","v":7},{"$f":"COUNTBLANK('3. Legality risks benefits'!I2:I10)","v":9},{"$f":"COUNTBLANK('4. Data sharing agreement&logs'!I2:I21)","v":20},{"$f":"COUNTBLANK('5. Accuracy quality retention'!I2:I10)","v":9},{"$f":"COUNTBLANK('6. Info security'!I2:I16)","v":15},{"$f":"COUNTBLANK('7. Disclosures'!I2:I9)","v":8},{"$f":"COUNTBLANK('8. Bulk transfers personal info'!I2:I10)","v":9},{"$f":"COUNTBLANK('9. Urgent emergency info share'!I2:I7)","v":6},91]
[]
[]
[null,"Not started","Action rejected","On track","Overdue","Completed","Blank"]
[null,{"$f":"SUM(B18:J18)","v":0},{"$f":"SUM(B19:J19)","v":0},{"$f":"SUM(B20:J20)","v":0},{"$f":"SUM(B21:J21)","v":0},{"$f":"SUM(B22:J22)","v":0},{"$f":"SUM(B23:J23)","v":91}]

{"sheet":"Lookup","index":4,"n_rows":9,"n_cols":7,"rows_kept":9,"cut":false,"hidden":true,"merged":[]}
["Fully meeting our expectation",null,null,null,"Not started",null,"Not started"]
["Partially meeting our expectation",null,null,null,"Action rejected",null,"In progress"]
["Not meeting our expectation",null,null,null,"On track",null,"Overdue"]
["Not Applicable",null,null,null,"Overdue",null,"Completed"]
[null,null,null,null,"Completed"]
[]
[]
["2000-01-01"]
[{"$f":"TODAY()","v":"2024-09-17"}]

{"sheet":"1. Informed decision making","index":5,"n_rows":9,"n_cols":10,"rows_kept":9,"cut":false,"hidden":false,"merged":[[1,0,8,0],[1,1,8,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action Owner","Action Status","Due date\n(DD/MM/YYYY)"]
[1.1000000000000001,"Information sharing is considered and assessed carefully in line with legal requirements and policy. Decisions are documented and procedures are in place to ensure they are approved at the appropriate senior level. Staff likely to make decisions about sharing are adequately trained and made aware of legal requirements and responsibilities.","1.1.1","\tImplement clear policies, procedures and guidance about data sharing, including who has the authority to make decisions about systematic data sharing or one-off disclosures, and when it is appropriate to do so."]
[null,null,"1.1.2","\tIdentify staff that are likely to have responsibility for data sharing decision-making and ensure they have appropriate training, including induction and refresher training. "]
[null,null,"1.1.3","\tEnsure that staff who are likely to make decisions about sharing children's information complete specific training. "]
[null,null,"1.1.4","\tDocument all sharing decisions for audit, monitoring and investigation purposes (eg use the data sharing decision form template in the ICO's data sharing code)."]
[null,null,"1.1.5","\tInvolve the DPO in the decision-making process."]
[null,null,"1.1.6","\tDocument any advice from the DPO or other people involved in the decision-making process. "]
[null,null,"1.1.7","\tUndertake a data protection impact assessment (DPIA), or at least complete DPIA screening, to assess and work out how to mitigate any risks in proposed data sharing activities. "]
[null,null,"1.1.8","\tKeep policies related to systematic and one-off sharing under regular review to ensure these remain up-to-date and effective."]

{"sheet":"2. Privacy information","index":6,"n_rows":8,"n_cols":10,"rows_kept":8,"cut":false,"hidden":false,"merged":[[1,1,7,1],[1,0,7,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[2.1,"People are informed about their personal information being shared.","2.1.1","\tMake privacy information publicly available and ensure it actively informs people what information you are sharing, who you are sharing it with and the purpose for the sharing, in line with the requirements under article 13 UK GDPR (unless an exemption applies)."]
[null,null,"2.1.2","\tUse plain and age-appropriate language within privacy information to ensure it is accessible to the audience. "]
[null,null,"2.1.3","\tIdentify at least one lawful basis for sharing and provide this information in a way that people can understand. If more than one lawful basis applies, explain the circumstances and processing that each lawful basis applies to."]
[null,null,"2.1.4","\tGive clear direction in data sharing privacy information on how people may exercise their rights with the organisations that you are sharing their information with."]
[null,null,"2.1.5","\tInform people of any intention to transfer information to a third country or international organisation. This also includes any adequacy decision and appropriate safeguards, together with details on where to access them."]
[null,null,"2.1.6","\tUpdate privacy information to inform people about any changes to data sharing activities, including the impact of those changes. "]
[null,null,"2.1.7","\tPut agreements in place, where parties are acting as joint controllers, which specify their duties to provide privacy information under articles 13 & 14 (article 26 of the UK GDPR)."]

{"sheet":"3. Legality risks benefits","index":7,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[1,0,6,0],[1,1,6,1],[7,1,9,1],[7,0,9,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons fo Status","Actions","Action Owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.1","Complete an assessment of the legality of the sharing and document the outcome. "]
[{"$f":"A2","v":3.1},"There is a process to assess the legality of sharing and document any outcomes.","3.1.2","Ensure that the purpose of sharing is compatible with the purposes for which the information was originally collected (unless a valid exemption applies) (article 5(1)b or DPA18 section 36, or both)."]
[3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.3","Carry out a legitimate interest assessment (LIA), if you are relying on legitimate as the lawful basis for sharing.  "]
[3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.4","Document the lawful basis (article 9,10 or DPA18 section 35, or both) and relevant conditions from schedule 1 or 9 of the DPA18, if the information you are sharing includes special category or criminal offence information under the UK GDPR.  "]
[3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.5","Assess whether there is compelling reason to share it in line with the ICO’s data sharing code and the children’s code, prior to doing so."]
[3.1,"There is a process to assess the legality of sharing and document any outcomes.","3.1.6","For public authorities - Consider whether there is the legal power to share (outside the UK GDPR or DPA18) (ie a statutory obligation). Document the express or implied statutory legal power relied on."]
[3.2,"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.1","Complete a DPIA to assess the risks before entering into any new data sharing activity. There is an obligation to do this when sharing is likely to result in a high risk to people’s rights and freedoms. "]
[{"$f":"A8","v":3.2},"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.2","Always complete a DPIA if the data sharing involves children's personal information, in line with the data sharing code."]
[3.2,"There is a process to assess the potential risks and benefits of sharing and any outcomes are documented.","3.2.3","Seek input from all stakeholders to ensure that you properly consider risk factors when you are relying on a DPIA that is produced by other parties involved in the sharing."]

{"sheet":"4. Data sharing agreement&logs","index":8,"n_rows":21,"n_cols":10,"rows_kept":21,"cut":false,"hidden":false,"merged":[[17,1,20,1],[17,0,20,0],[1,1,4,1],[1,0,4,0],[5,1,10,1],[5,0,10,0],[11,1,16,1],[11,0,16,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYY)"]
[4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.1","\tEnsure data flow mapping analysis shows a clear differentiation between information that is shared with other organisations (C2C) and information that is processed by a data processor under instruction (C2P)."]
[{"$f":"A2","v":4.0999999999999996},"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.2","Have separate policies that clearly distinguish between the requirements for sharing information on a C2C or C2P basis."]
[4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.3","\tEducate staff on the distinction between C2C and C2P data sharing."]
[4.0999999999999996,"There is a clear understanding of the distinction between data sharing on a controller to controller (C2C) basis and the use of data processors who process information under instruction (on a controller to processor basis (C2P)) under the UK GDPR and the DPA 2018.","4.1.4","Avoid using data sharing agreements that are drafted for use on a C2C basis, if you are instructing third-party processors to process information under instruction."]
[4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.1","\tAgree written data sharing agreements with all the relevant parties and ensure senior management sign them off."]
[{"$f":"A6","v":4.2},"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.2","Include the following details in data sharing agreements:\n-\t the parties' roles;\n-\t the purpose of the data sharing;\n-\t what is going to happen to the information at each stage; and\n-\t the standards set (with a high privacy default for children)."]
[4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.3","\tImplement procedures and guidance covering day-to-day operations to support the agreements."]
[4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.4","Where information is shared with parties outside the UK: \n-\t check whether the restricted transfer is covered by adequacy regulations or an article 49 exemption applies; and\n-\t if not, carry out a risk assessment and implement an article 46 transfer mechanism (along with any required additional steps or protections)."]
[4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.5","\tEnsure agreements specify which controller is the contact point for people to exercise their rights, if parties are acting as joint controllers (article 26 of the UK GDPR and section 58 of the DPA18)."]
[4.2,"Data sharing agreements are agreed with all parties that personal information is routinely shared with and are sufficiently detailed (give sufficient direction to both parties to ensure that the requirements of the law are met).","4.2.6","For public authorities - Ensure the agreement covers responsibilities and procedures for responding to freedom of information requests and the need to include certain types of information in publication schemes."]
[4.3,"There is a log or record of all data sharing agreements.","4.3.1","\tKeep a log of sharing agreements that details the nature of the sharing and the partners."]
[{"$f":"A12","v":4.3},"There is a log or record of all data sharing agreements.","4.3.2","Include data sharing within the data mapping and data flow analysis. "]
[4.3,"There is a log or record of all data sharing agreements.","4.3.3","\tAssign information asset owners (IAOs) to oversee any information sharing within their information assets."]
[4.3,"There is a log or record of all data sharing agreements.","4.3.4","Include data sharing information on the record of processing activities (ROPA). Include categories of recipients that personal information will be disclosed to, including recipients in third countries or international organisations."]
[4.3,"There is a log or record of all data sharing agreements.","4.3.5","Maintain a record of what was shared and when, so you can: \n- \tact on a person’s request to exercise their rights under UK GDPR; or \n- \tknow whether they are affected if there is a data breach"]
[4.3,"There is a log or record of all data sharing agreements.","4.3.6","\tPut in place appropriate information tracking, tracing and labelling procedures to understand what information has gone where and when. In particular, if there are large information transfers or information is shared to enable artificial intelligence services."]
[4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.1","\tCreate a review process to regularly examine whether data sharing under your agreements continues to be appropriate."]
[{"$f":"A18","v":4.4000000000000004},"Data sharing agreements are reviewed on a regular basis.","4.4.2","\tEnsure partner organisations are removed from or added to agreements, when required."]
[4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.3","Implement processes to review agreements following: \n- \ta change in circumstances for sharing partners;\n- \ta change in the reason for the data sharing; \n- \ta significant complaint; or \n- \ta security breach."]
[4.4000000000000004,"Data sharing agreements are reviewed on a regular basis.","4.4.4","\tRegularly include the outcomes of the reviews on the agenda for the information governance board (or equivalent)."]

{"sheet":"5. Accuracy quality retention","index":9,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[1,12,6,12],[7,11,9,11],[7,12,9,12],[1,1,6,1],[1,0,6,0],[7,1,9,1],[7,0,9,0],[1,11,6,11]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due date\n(DD/MM/YYYY)"]
[5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.1","\tMinimise shared personal information to agreed data sets or redact and clearly distinguish between fact and opinion."]
[{"$f":"A2","v":5.0999999999999996},"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.2","\tCreate a process to assess whether the information shared is as complete as possible (within the bounds of what you have defined and agreed to share)."]
[5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.3","\tSeek technical advice before sharing information, if different systems are involved."]
[5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.4","\tRecord information in the same format, abiding by open standards when applicable."]
[5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.5","\tInform recipients when you amend or update shared information."]
[5.0999999999999996,"There are controls in place to ensure that the information shared is adequate for the purpose, accurate and of appropriate quality.","5.1.6","\tImplement regular quality checks or verification processes to assess whether shared information is accurate and up-to-date. This applies to all sharing partners."]
[5.2,"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.1","\tEnsure common retention and disposal arrangements are agreed between all parties prior to sharing information. "]
[{"$f":"A8","v":5.2},"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.2","\tDocument the agreed retention and disposal arrangements within data sharing agreements."]
[5.2,"There are controls in place to ensure that the information shared is not retained for longer than necessary by all parties.","5.2.3","Seek guarantees that recipients will delete, destroy or return shared information:\n- \tonce the purpose is served; \n- \twhen a relevant retention period expires; or \n- \tin the event of a breach, if appropriate."]

{"sheet":"6. Info security","index":10,"n_rows":16,"n_cols":10,"rows_kept":16,"cut":false,"hidden":false,"merged":[[1,1,6,1],[1,0,6,0],[11,0,15,0],[7,1,10,1],[7,0,10,0],[11,1,15,1]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.1","\tAnalyse the risks to determine the appropriate security measures for information that is transmitted or received. For example, by assessing the nature and sensitivity of the shared information. Also assess the confidentiality of the shared information, or any protective marking scheme. For example, encrypt 'confidential' personal information."]
[{"$f":"A2","v":6.1},"There are appropriate security measures in place to protect the information received and transmitted.","6.1.2","\tSet out how information will be shared (and the agreed security standards) within written agreements and supporting procedures. For example, by recorded post, encrypted email or secure file transfer protocol (SFTP)."]
[6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.3","\tActively obtain regular assurance on the security of any intermediate platform used for sharing information that is not under your direct monitoring and control."]
[6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.4","\tEstablish a back-up process to ensure you can restore access to information in the event of a breach. "]
[6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.5","\tReview and re-confirm security measures and assurances between sharing partners on a regular basis or when any of the partners make changes to its IT systems or security protocols."]
[6.1,"There are appropriate security measures in place to protect the information received and transmitted.","6.1.6","\tDocument and implement overarching information security policies and procedures across the organisation."]
[6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.1","\tEnsure sharing partners provide documented access control policies."]
[{"$f":"A8","v":6.2},"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.2","\tObtain assurances that access control is formally implemented by all sharing partners."]
[6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.3","\tObtain assurances from sharing partners that only agreed points of contact or specific categories of employee have access to the shared information."]
[6.2,"There are appropriate levels of access control in place if information is shared by giving third parties direct access to systems.","6.2.4","\tRegularly test, assess and evaluate the effectiveness of the access control measures that you have implemented."]
[6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.1","\tEnsure sharing partners provide documented incident management procedures."]
[{"$f":"A12","v":6.3},"There are effective incident management procedures in place with all sharing partners.","6.3.2","\tObtain assurances that formal incident management procedures are implemented and regularly tested."]
[6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.3","\tEnsure there are procedures in place to promptly report, investigate, and resolve security incidents."]
[6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.4","Establish key points of contacts with all sharing partners so that incidents can be reported quickly and investigated."]
[6.3,"There are effective incident management procedures in place with all sharing partners.","6.3.5","\tKeep a log of actual and potential security incidents relating to data sharing."]

{"sheet":"7. Disclosures","index":11,"n_rows":9,"n_cols":10,"rows_kept":9,"cut":false,"hidden":false,"merged":[[1,1,3,1],[1,0,3,0],[4,1,8,1],[4,0,8,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[7.1,"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.1","\tImplement a policy or procedure for responding to ad hoc third-party requests for personal information and communicate it to staff."]
[{"$f":"A2","v":7.1},"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.2","\tKeep a record on the person's file, spreadsheet or monitoring documents indicating when there is a verbal or written disclosure to third parties."]
[7.1,"Procedures are in place for responding to ad hoc third-party requests for personal information.","7.1.3","\tConsider whether you should put a data sharing agreement in place with the third party, if their ad hoc requests become more frequent."]
[7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.1","\tKeep a record on the person's file, in a spreadsheet or monitoring documents indicating verbal or written disclosures to third parties."]
[{"$f":"A5","v":7.2},"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.2","\tKeep a record of the steps taken to identify the nature of the disclosure, the requester and the reason for it."]
[7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.3","\tKeep a record of all disclosure approvals, where appropriate"]
[7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.4","\tConduct quality assurance on verbal and written disclosures to provide assurances that staff are following procedures  and actioning disclosures lawfully."]
[7.2,"Written records are kept of responses and approvals for third-party requests for personal information.","7.2.5","\tLog all inappropriate disclosures as a personal data breach and take appropriate action. "]

{"sheet":"8. Bulk transfers personal info","index":12,"n_rows":10,"n_cols":10,"rows_kept":10,"cut":false,"hidden":false,"merged":[[1,1,9,1],[1,0,9,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[8.1,"There are active operational controls and processes in place to ensure that large volumes of information in a database or list are being shared in compliance with the law.","8.1.1","\tEnsure written data sharing agreements are detailed enough to meet the requirements of the data sharing code."]
[null,null,"8.1.2","\tEnsure data sharing agreements are signed off by senior management."]
[null,null,"8.1.3","\tTrain teams involved in configuring or generating bulk personal information transfers appropriately. "]
[null,null,"8.1.4","\tEnsure these teams clearly understand the authorisation processes, prior to releasing any information or adjusting existing data sets."]
[null,null,"8.1.5","\tDevelop an approval process for adjustments to existing data sets before changes are actioned. Evidence the change management process. "]
[null,null,"8.1.6","\tClearly define the specific roles that have the authority to configure or generate data sets for release to data sharing partners."]
[null,null,"8.1.7","\tClearly define the specific roles that have the authority to release information to sharing partners. "]
[null,null,"8.1.8","Tell sharing partners: \n- \tthe source of the information; \n- \tthe lawful basis you obtained it on;\n- \thow you initially collected it; and \n- \twhat you told people at the time about the purposes you are processing it for."]
[null,null,"8.1.9","\tImplement processes to monitor platforms and other data sharing mechanisms and ensure they are functioning as they should."]

{"sheet":"9. Urgent emergency info share","index":13,"n_rows":7,"n_cols":10,"rows_kept":7,"cut":false,"hidden":false,"merged":[[1,1,6,1],[1,0,6,0]]}
["Number","Our expectations","Reference","Ways to meet our expectations","Current Status","Reasons for Status","Actions","Action owner","Action Status","Due Date\n(DD/MM/YYYY)"]
[9.1,"There are plans in place that can be activated should information need to be shared rapidly in an urgent situation or emergency.","9.1.1","\tConsider and document the types of information you are likely to need to share in advance and where this is held."]
[null,null,"9.1.2","\tDocument clear plans that outline when and how you share information in an emergency and who has authority to make these decisions."]
[null,null,"9.1.3","\tInclude a risk assessment as part of any pre-existing DPIA, and refer to business continuity and disaster recovery plans."]
[null,null,"9.1.4","\tConsider and document all security measures that you will take if you are required to share in an urgent situation or emergency."]
[null,null,"9.1.5","\tPut data sharing agreements in place for this type of emergency sharing in advance, where you know the likely sharing partners."]
[null,null,"9.1.6","\tTrain staff on emergency plans and how to share information in these situations."]