If you are unsure whether to use consent as your legal basis, please read below. Consent to process personal data has legal definition under data protection legislation. This is not the Consent to process personal data has legal definition under data protection legislation. This is not the same as consent to take part in a research study or for medical treatment, which may be required under different legislation. There are usually more appropriate legal bases for processing personal, health and social care data, apart from consent. However, if consent to process personal data is the legal basis used, all the relevant rights of the subjects must be upheld (see Table 3 , Appendix B) including the right to be erased (or forgotten). If this is not possible then, consent should not be used as a lawful basis for processing data. In relation to consent, the ICO states: ' Consent is one lawful basis for processing, but there are alternatives. Consent is not inherently better or more important than these alternatives. If consent is difficult, you should consider using an alternative. Consent is appropriate if you can offer people real choice and control over how you use their data, and want to build their trust and engagement. But if you cannot offer a genuine choice, consent is not appropriate. If you would still process the personal data without consent, asking for consent is misleading and inherently unfair. If you make consent a precondition of a service, it is unlikely to be the most appropriate lawful basis. Public authorities, employers and other organisations in a position of power over individuals should avoid relying on consent unless they are confident they can demonstrate it is freely given. '

3.2.01 Please indicate if your proposal is substantively in response to, or calls upon, a statutory or regulatory requirement placed upon your organisation. This might include the exercise of a statutory power, or a regulatory requirement to carry out audit or monitoring under specific legislation. Please provide details of any statutory or regulatory basis to support the proposal. 3.2.01a If yes, please give details and cite the specific statues from the legislation involved. 3.2.02 If you are applying to HSC-PBPP, then someone must be processing personal and special category data, either yourself or someone else on your behalf. Therefore, you must provide the lawful bases for this data processing under current data protection legislation. To help, the most common appropriate lawful bases for health data are provided. 3.2.02a Please tick the appropriate lawful basis for processing personal data under GDPR article 6.1. The different legal bases are listed in Table 4 of Appendix B, but the most appropriate for the use of health data are provided in the application form. 3.2.02b Please tick the appropriate lawful basis for processing special category data under GDPR article 9.2. The different legal bases are listed in Table 5 of Appendix B, but the most appropriate for the purposes generally used for health data are given. Under the Data Protection Act 2018, some legal bases for processing data under article 9.2 of GDPR also require a condition from Schedule 1. These are also provided in Table 5 of Appendix B. This also needs to be consistent with those in section 1: e.g. if the applicant is reliant on 9.2.i, then for condition 3, the work must be carried out under the responsibility of a clinician / health professional and this would be the applicant and/or clinical lead. 3.2.02c Please indicate the specific group of people who will process any personal and special category data, whether it will be you or done on your behalf. 3.2.03 Please provide any existing agreements (e.g. data processing agreements, information sharing agreements or contracts) which are in place which support your proposal. This can include any formal documented procedures or agreements which facilitate the exchange or sharing of information in ways or between parties or organisations relevant to your application. Such procedures can indicate both a basis for access, sharing or transfer of information, and also the existence of controls in place to ensure that risk is minimised where data is processed in this way.