Registration process

To request registration, individuals and organisations complete an online form with information about themselves. The information submitted through the form is then assessed against the SDE Network's registration criteria to check if the applicant is suitable.

Once registered, individuals and organisations are considered suitable to approach any of the regional SDEs and make a data access request for the specific data they need for their research project. 

Being registered at SDE Network level does not guarantee access to specific data. All data access requests are processed by the SDE providing that data. As part of their process, SDEs may ask for more detailed information about the individual, the organisation or the proposed project and carry out additional checks before granting access to data.

Registration only needs to happen once to enable researchers to request data from any of the regional SDEs in the SDE Network. Researchers begin discussing projects with SDEs while they are waiting for their registration to be confirmed. 

You must be registered before you are given access to NHS data. However, registration is only one step in the process of gaining access to NHS data and there will be other steps, depending on the specific data your research needs. 

If you've already been approved to use the Health Data Research Gateway, you still need to apply for SDE Network registration as it's a separate process, in line with public expectations.

If you are filling out the form on behalf of an organisation, you should be:

• employed by the organisation directly, or contracted by the organisation to carry out administrative tasks on their behalf
• empowered to make declarations on behalf of the organisation

You will be the key contact.

Your role should give you sufficient authority to sign off on legal documents/contracts on behalf of your organisation, or on behalf of a particular division/unit of the organisation.

You'll be asked to provide details such as:

• your organisation's name
• the type or purpose of the organisation
• its location
• its sector of operation
• contact details for key personnel

You will also be asked to provide evidence of your organisation's governance around data standards, and to make statements about how the organisation aligns with NHS principles and values.

Eligibility

To become registered, organisations need to demonstrate robust data security and information governance. This can be through:

• Data Security and Protection Toolkit (DSPT) - this is the preferred UK standard
• other recognised frameworks such as Cyber Essentials or ISO:27001

Non-UK organisations can apply using equivalent local standards. If an organisation does not have DSPT additional questions or evidence will be required. International applications may require more time for registration, so starting the process early is advised.

If you have any questions or are unsure, email the team at [email protected] and they will be able to help.

SDE Network registration requires organisations providing assurance about individuals with whom they have a contractual relationship. 'Contractual relationship' most often means people directly employed by your organisation but could extend to other kinds of contractual relationship such as sponsorship or sub-contracts with other organisations to use their staff for a project. 

When an individual applies to be registered, they name one or more organisations on their application form.

It is the responsibility of those named organisations to verify that the individual is who they claim to be, and that in the view of that organisation they are considered suitable to apply to access NHS data. This process is referred to as 'vouching'. Once your organisation has vouched for an individual, the conduct of that individual while accessing NHS data will become your responsibility. Should the individual breach their terms of use while using NHS data, your organisation will be accountable.

Your organisation should name 1 or more individuals responsible for responding to vouching requests.

These vouching contacts should ideally be named staff members at your organisation who will be directly responsible for completing and returning the vouching requests (such as an HR administrator, head of unit or unit manager).

Larger organisations may have more than 3 potential vouching contacts. If so, the vouching contact can also be:

• a generic contact for a department/unit at the organisation that will be directly responsible for completing and returning the vouching requests (such as an HR administrator or the research department administrative officer)
• a generic contact for the organisation that will be responsible for triaging vouching requests and sending them on to the correct departments/staff members who will then be responsible for completing and returning the vouching requests (such as the main office/reception)

In your registration application form, you'll need to provide:

• your name
• methods of contacting you
• details of any relevant professional registrations you have
• details of your current employment

This must include at least one organisation you are currently associated with (most likely to be your current employer), as they will be contacted to provide assurance. You can name more than one.

You must confirm and/or show that you have completed your organisation's information governance and data protection training. Check with your organisation if you are unsure about having completed this.

You must read and agree to the terms and conditions for accessing NHS data as part of your application. Submitting your form indicates agreement to those terms and conditions.