NHS England Data Sharing Remote Audit: University of Manchester

Purpose

This report records the key findings of a remote data sharing audit of the University of Manchester (UoM) and University of East Anglia (UoEA) between 29 September and 1 October 2025. It provides an evaluation of how UoM and UoEA and its Processors conform to the requirements of:

• the data sharing framework contracts (DSFC)

• CON-326191-T0T6B-v2.02
• CON-324412-Y0F4Z-v2.03 (UoEA)  

• the data sharing agreements (DSA)

• DARS-NIC-147811-YTH88-v5.2
• DARS-NIC-333021-B6W2C-v3.5

• the organisations’ own policies, processes and procedures

These DSAs cover the provision of the following datasets:

The joint Controllers and Processors are UoM and UoEA.

The Norfolk Arthritis Register (NOAR) started in 1989 and is a long term study of inflammatory arthritis in the community. The purpose of the Register is to study the natural history of arthritis and to identify genetic and non genetic factors which may be related to the onset of arthritis, response to treatment, and to long-term outcome. This study is also interested in learning more about the effects which arthritis may have on other medical conditions.

The data was supplied for the purpose of the NOAR. NOAR is a large community based study investigating the cause and outcome of inflammatory polyarthritis (inflammation and swelling of the joints). The Register is funded by the Arthritis Research Campaign through a grant to its Epidemiology Unit based at the University of Manchester. NOAR is a satellite of the Epidemiology Unit and is based in the Department of Rheumatology at the Norfolk and Norwich University Hospitals.

The interviews during the audit were conducted through video conferencing.

This is an exception report based on the criteria expressed in the Data Sharing Audit Guide version 4

Audit type and scope 

Data recipient’s acceptance statement

UoM has reviewed this report and confirmed that it is accurate.

Data recipient’s action plan

Since the Audit Team has not identified any nonconformities, observations or outstanding information, there is no requirement for UoM to produce a corrective action plan. Therefore, no post audit review will be conducted by the Audit Team.

The Audit Team has identified 1 opportunity for improvement which is provided for reference only and will not be followed up as part of any post audit review.

The following 1 point for follow-up was raised as part of the audit.

The following table identifies 1 opportunity for improvement which could help an organisation improve its controls or processes.

Use of data

UoM confirmed that the datasets were only being processed and used for the purposes defined in the DSAs and were not being linked with another dataset. 

Data location

UoM confirmed that processing and storage locations, including disaster recovery and backups, of the datasets were limited to the location shown in the following table. These locations conform with the territory of use defined in section 2c of the DSA.

The audit was based upon a sample of the data recipient’s activities, as observed by the Audit Team. The findings detailed in this audit report may not include all possible nonconformities which may exist. In addition, as the audit interviews were conducted through a video conference platform, certain controls that would normally be assessed whilst onsite could not be witnessed. 

NHS England has prepared this audit report for its own purposes. As a result, NHS England does not assume any liability to any person or organisation for any loss or damage suffered or costs incurred by it arising out of, or in connection with, this report, however such loss or damage is caused. NHS England does not assume liability for any loss occasioned to any person or organisation acting or refraining from acting as a result of any information contained in this report.