This also applies to participants as well as variables. If you don't know what data you will require to develop a larger project, a smaller pilot study might be appropriate. Under data minimisation principles, all variables should be clearly justified as to why they are necessary and required for the proposal, to indicate that these are the minimum dataset required to achieve the stated objectives of the application. Variables that are directly identifiable, or in combination with other variables could make individuals identifiable, should be particularly justified.

#### 4.3 Data Variables

This section should provide a full, clear account of all the data variables included within your proposal. This can be provided as the eDRIS Project Specification Document (PSD) or in table 4.3. If you use a separate variables document, it must have the same information as that requested in the table. Please include all variables that are required, including those for ' processing only ' .

Processing only only variables are those that will be used only in processing of the data on your behalf but will not be provided to you in the dataset for analysis. If you require such variables (e.g. CHI for data linkage, to provide a derived variable [e.g. postcode for deprivation scores, date of birth to calculate age at an event], prior to pseudonymisation or for matched control purposes) , please tick the 'processing only' box. If your proposal will make direct use of the data (i.e. you will receive the variable in question), then the processing only box should remain unticked. Examples of your proposal making direct use of the data may include linked data extracts, IT front end of a database or results of case file audit. Please include any derived variables, for example those included in an output file.

Please list the dataset name or data source from which each variable will be obtained, and list each variable by name. Please indicate the time period over which the variable required extends. For data minimisation purposes, each variable should be justified briefly as to its necessity for your proposal.

If you are requesting identifiable or potentially identifiable variables please ensure you justify your requirement for this level of data in each case so that the appropriateness, proportionality and risk associated with their disclosure can be carefully considered.

#### 4.4 NRS / NHSCR Data Sources

This section establishes if the proposal seeks to use data originating from National Records of Scotland (NRS), including the NHS Central Register (NHSCR), and if so, in what way. Please note that this excludes births, stillbirths and death registration data as a copies of these are held by PHS as part of a long standing agreement with NRS. These should be listed in Q 4.2, with NRS as the data controller.

Please note that if cancer flagging is requested, NHSCR will require an IT security review for section 5 by NRS prior to submission to HSC-PBPP. If such a review is required, and if the application is using a Regional Safe Haven, then sections 5.1 and 5.2 will have to be completed, regardless of whether Q 3.4.01 has been ticked. This is a requirement of the NHS Central Register.

4.4.01 Please indicate if the proposal requires access to the NHS Central Registry (NHSCR) or any National Records of Scotland involvement, not mentioned in 4.2 (see note above).

###### If no such data is required by the proposal, please choose 'No' and proceed to question 4.5.