​NHS England Data Access Audit: Evidera Ltd

Purpose

This report records the key findings of a remote data access audit of Evidera Ltd between 2 and 6 June 2025. It provides an evaluation of how Evidera Ltd conforms to the requirements of:

• the data sharing framework contract (DSFC) CON-313304-M4K1F-v2.03
• the data sharing agreement (DSA) DARS-NIC-561357-X0F3N-v3.2
• the organisation’s own policies, processes and procedures

This DSA covers the provision of the following datasets: 

The Controller is AstraZeneca UK Ltd and the Processor is Evidera Ltd.  

AstraZeneca UK Ltd requires access to NHS England data to generate the evidence necessary to understand the unmet need in the preventions and treatment of COVID-19 following the deployment of vaccination campaigns. 

Although COVID-19 is declining following the rollout of vaccination, certain populations like immunocompromised and elderly are still disproportionately impacted. This study continues to provide key contemporary evidence on the burden of COVID-19 in high risk populations. Furthermore, this continues to inform the assessment and usage guidance of new generations of COVID-19 prophylaxis and treatments. 

AstraZeneca UK Ltd is the sponsor and the controller organisation responsible for ensuring the data will be processed for the purpose described in the DSA. 

Evidera Ltd has been contracted by AstraZeneca UK Ltd to conduct this piece of research, acting as the sole data processor, Evidera Ltd will be the only entity to process the data. Data is held within the Secure Data Environment (SDE). 

The interviews during the audit were conducted through video conferencing.  

This is an exception report based on the criteria expressed in the Data Sharing Audit Guide version 4. 

Audit type and scope

Data recipient’s acceptance statement

AstraZeneca UK Ltd and Evidera Ltd have reviewed this report and confirmed that it is accurate.

Data recipient’s action plan

AstraZeneca UK Ltd will establish a corrective action plan to address the finding shown in the table below. The Audit Team will validate this plan and the resultant actions will be followed up with AstraZeneca UK Ltd by the IG Risk and Assurance team at NHS England to confirm the finding has been satisfactorily addressed.

The Audit Team has identified 4 opportunities for improvement which are provided for reference only and will not be followed up.

The following table identifies the 1 agreement nonconformity raised as part of the audit.

The following table identifies 4 opportunities for improvement which could help an organisation improve its controls and processes.

Use of data

AstraZeneca UK Ltd and Evidera Ltd confirmed that the datasets were only being processed and used for the purposes defined in the DSA and were not being linked with another dataset.

The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed. 

NHS England has prepared this audit report for its own purposes. As a result, NHS England does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS England does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.