Universal information governance (IG) templates

NHS England has produced a suite of universal information govenrance (IG) templates to support the lawful use of data within health and care. These templates may also be used by organisations in other sectors, particularly where they use or share data with health and care organisations.

The adoption of the templates is non-mandatory. However, all organisations using and sharing health and care information are encouraged to use these templates to reduce duplication and facilitate collaborative work across the system.

These templates have been developed with expert input from colleagues from a variety of local health and care organisations.

They have been reviewed and updated following the implementation of the Data (Use and Access) Act 2025.

Universal information governance templates

ARTICLE

Data protection impact assessment (DPIA)

A data protection impact assessment (DPIA) is a process that helps you systematically identify, analyse and where possible mitigate the data protection risks of specific projects, plans or activities within your organisation. This DPIA template can be used for any use of health and care data or other data, such as employment data.

ARTICLE

Data sharing and processing agreement (DSPA)

This NHS England template data sharing and processing agreement (DSPA) combines the requirements of a data processing agreement (DPA), data sharing agreement (DSA), and joint controller arrangement (JCA). The DSPA is a legal document which sets out the roles and responsibilities for 2 or more parties that are sending, receiving or using data.

ARTICLE

Information assets and flows register (IAFR)

An information assets and flows register (IAFR) is a document which holds details of all the information assets within your organisation. It includes electronic data, such as the shared care record, and physical assets, such as paper case notes.

ARTICLE

Privacy notice (PN)

A Privacy Notice (PN) is a document which informs people about how their data is being used, what their rights are under data protection legislation, and how they can exercise them.

Training

ARTICLE

Becoming an information asset owner

This session will explore the responsibilities of an information asset owner and explain why care organisations need to manage their information assets carefully.

Read the summary of main updates

Changes applied across the suite:

Formatting changes to support accessibility and usability

greater contrast of highlighted text
removal of many tables
addition of text boxes
collapsible, updated guidance notes

Content changes

further simplified and clarified wording
update and addition of new links to other guidance
update to the list of commonly used health and care laws

Legal basis

all possible legal bases (including recognised legitimate interests) included for completeness, with a steer on applicability
DPA 2018 Schedule 1 conditions referenced for completeness

Specific Data Protection Impact Assessment (DPIA) changes

addition of options and prompts to security measures
significant update to automated decision-making section and prompts to consider artificial intelligence (AI) throughout
addition of question to capture other relevant organisations, such as commissioners
addition of columns in risk assessment table

Specific Information Asset Flows Register (IAFR) changes

addition of explanation of how people can add functionality to the sheet
addition of drop-down list options
addition of business function column

Last edited: 7 May 2026 12:43 pm