or other designated person. These might differ with each organisation, but the Data Protection Officer or Information Governance team for your organisation should be able to advise.

#### 3.1.17a If a DPIA has not been carried out, have the ICO screening questions been carried out and accepted by your organisation?

3.1.17b If neither a DPIA nor the screening questions have been done, then you will need to explain and justify why not, and also how your application has been suitably assessed for the risks associated with the processing (by yourself or by others on your behalf) of personal health data. If the proposal will access the requested data in an accredited Safe Haven (national or regional) and there is no overarching DPIA in place to cover the processing of the personal and special category data prior to the data being made available to the research team, please describe how the use of a Safe Haven mitigates the privacy risks inherent in processing such personal and special category data. 3.1.18 Please indicate if there is any commercial aspect or dimension to the proposal or its outcomes. This would include any involvement of commercial organisations at arm's -length to the proposal, (e.g. outsourced processes, funding, spin-out company), access to data by a commercial company, use of data for a proposal that will be commercialised, or likely impact on commercial organisations, individually or collectively, that might result from the outcomes or methodology of the proposal. Any involvement of a commercial company, needs to be explained carefully as these companies will potentially make money out of the use of free health data. If the commercial organisation is based outside the European Economic Area (EEA), then special consideration has to be made as GDPR does not allow personal data to be transferred outside the EEA. 3.1.18a Please justify the necessity of the commercial involvement, how it is necessary for the success of the proposal and what the company will gain from their involvement in this proposal. This information is helpful to the reviewers to determine the public benefit against the privacy risk of the use of patients' health data for the purposes of the commercial company. More specific guidance for work that involves commercial applications is currently being updated and will be included in an appendix to these notes. 3.1.18b Please provide a list of the partners involved and an explanation of how partners in NHS Scotland have been involved in any discussions of the commercialisation and describe how NHSScotland will benefit from such use of patients' health data? Please provide a formal agreement between the partners so that reviewers can be assured that suitable arrangements are in place for the commercialisation of the outcomes from the use of NHSS data. 3.1.18c Please describe how the commercialisation of any product or outcome and the intellectual property associated with that, will be handled and by whom? Will it be by the company, the applicant's organisation.

#### 3.2 Statutory and Regulatory Context

This section explores the statutes and regulations relevant to the proposal, and ensures that confidentiality, Data Protection and Caldicott obligations have been accounted for. It identifies key controls in place to help reduce risks to individual privacy.

Personal data data are those which individually, or in combination, identifies an individual: e.g. name, address, postcode, date of birth, identifiable code number (e.g. National Insurance number, CHI number). Special category data category data are personal data that needs more protection because it is considered to be sensitive. A list of special category data is provided in Table 6 of Appendix A.