considered as sensitive in nature. Any other special category data that is non-health (e.g. ethnicity, religion) should be stated here. This is part of the assessment of how safe is a proposal. 3.1.13a If highly sensitive data, or non-health special category data are required, please provide details and justification of the variables requested. 3.1.14 Please indicate whether the proposal seeks to use information exclusively about deceased persons. This includes where the proposal seeks to access and use individual datasets which consist only of information relating to deceased persons. Please provide details of the relevant data sources. Please note that while deceased people are not subject to data protection law, they are still subject to the common law duty of confidentiality and laws that govern access to their health records. If someone is deceased, the manner of their death may be quite sensitive (e.g. drug overdose, suicide) which may cause some distress to the surviving family and friends. Therefore, the data requested may need to be handled carefully and as safely as if they were still alive. 3.1.15 Please describe how any members of the public, lay representatives or patient groups have been involved in the design or any other aspects of the proposal. This would include details of any public engagement or consultation activity which has been undertaken in the course of designing the proposal. Any supporting evidence resulting from consultation should be provided as supporting evidence. 3.1.15a Please include details as to how this public / lay input affected the design or any other aspect of your proposal, e.g. lay input into a questionnaire about their experience of having this condition, or what would be their research priorities. 3.1.15b Please provide details of your plans of how you will keep the public, lay representatives or patient groups informed about the ongoing use of health data for this application and its outcomes. E.g. this could include newsletters, emails public presentations, workshops. 3.1.16 Please describe any process under which your proposal has been reviewed by any other people, e.g. formal external scientific peer review for research funding, or internal review or review by a third party. Please give details of how this was undertaken, including bodies or organisations involved. If no formal external review has been done, please explain why not. 3.1.17 This question relates to whether a Data Protection Impact Assessment (DPIA) is required and has been carried out for this application or a bigger overarching proposal under which this proposal sits. If you are applying to HSC-PBPP, personal identifiable data and special category data, will be processed for your proposal, even if it is not done by you but on your behalf. Such processing should comply with the Caldicott Principles ( Table 1 Appendix B) and Data Protection Principles ( Table 2 Appendix B). In general, for processing of personal and special category data, the ICO suggest that a DPIA should be carried out as the proposal is designed, so that privacy issues are thought through as the proposal is developed. This is called Privacy by Design. In addition, carrying out a DPIA is good practice. The Information Commissioner's Office ( ICO) website has a lot of information about DPIAs, including screening questions as to whether a Data Protection Impact Assessment (DPIA) is a legal requirement for your proposal. (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection- regulation-gdpr/accountability-and-governance/data-protection-impact-assessments/) A DPIA is a recognised control for identifying and assessing risk where data is being processed, and may be mandatory for some proposals which are processing personal data. A DPIA should have commenced in the early stages of planning a project and before an application is submitted to the HSC-PBPP. The completed DPIA should be signed- off by your organisation's Data Protection Officer or IG Lead or Information Asset Owner or Senior Information Risk Owner (SIRO)