3.4.05 Please indicate whether access to the NSH will be required by anyone working from home? 3.4.05a if yes, please state whether your organisation has a home working policy, and provide it as a supporting document. Please outline any mitigation measures that are in place to ensure that access to the safe haven will be secure.

## Section 4: Safe Data, Data Subjects and Methodology

#### 4.1 New Data yet to be collected

This section should indicate which data sets are being newly collected for the purpose of this proposal. If no such collection of new data is proposed, please proceed to question 4.2. The emphasis here is on the collection of new data , as distinct from the creation of new dataset from existing data (for example by linkage or extracted from case notes) or data collected prior to the application.

For each source of new data, you should clearly identify which party (organisation or individuals referenced within the proposal) will be collecting the new data.

#### 4.2 All Other Existing Datasets / sources

This section should indicate data sources or data sets that are already in existence, and are not being newly collected for the purposes of the proposal. This will include each existing local or national data set or source which your proposal seeks to access, and could include extracts from hospital systems, or research databases. It establishes that appropriate permission has been received for the data to be accessed and used in the manner proposed. Please note that contact should be established as early in the process as possible with NHS boards and data providers to discuss data provisioning requirements.

Please list each such data set or data source. Provide the name of the dataset or source, and the name of the current data controller of the data. If the data controller is not from NHSScotland, you should append documentation or details to illustrate your permission to use these data. If you will receive data indirectly (e.g. NRS Deaths from the copy held by PHS), the original data controller should be given (i.e. NRS in this example).

4.2.01 Include an explanation of how individuals who are the subject of the data were originally informed that their data would be used for your proposal specifically (e.g. participants were asked about the collection of their data from their medical records for this research), or more generally (e.g. privacy notices provided by the NHSScotland boards state that patient data may be used and shared for research). You should ensure that you include an appropriate explanation for your participants for each of the data sources which you have listed. If your application is focussed on participants who are particularly vulnerable, e.g. those with dementia, learning disabilities, live chaotic lives, you might need to think more about more appropriate routes for informing patients about the use of their data, than relying on generic data protection privacy notices provided by NHS Boards, or those on websites to which your participants may not have access. Data Protection privacy notices and information to the participants need to be GDPR-compliant and transparent regarding how data will be used and by whom. 4.2.02 Please explain how the principle of data minimisation has been applied in this application. This is the principle within data protection law such that data are sufficient, relevant and limited to what is necessary in relation to the purposes for which they are processed ('data minimisation'). Therefore, you can only ask for that data that you need to achieve your purposes. This means that you cannot ask for all available data and then work out what you require once you have it all.