---

Genomics: Data Protection

Answer

All organisations that have access to National Health Service patient data and systems must use the Data Security and Protection Toolkit (DSPT) to provide assurance on an annual basis that they are practising good data security and that personal information is handled correctly. In September 2025, we introduced the Cyber Assessment Framework (CAF) to aligned DSPTs in order to raise DSPT requirements for genomics organisations as suggested by the Department. The CAF is the National Cyber Security Centre’s framework and focuses on outcomes and principles to guide good decision-making, and the CAF-aligned DSPT return is supported by an independent audit to the mandated framework.

National cyber teams are tackling the changing cyber risk head-on through their ambitious Cyber Improvement Programme, expanding protection and services to better protect the health and care system, backed up with over £338 million of investment since 2017.

Patients who are offered whole genome sequencing through the NHS can consent to having their genomic data stored in the National Genomic Research Library (NGRL) which is run by Genomics England. Data stored in the NGRL is de-identified and access to it is carefully controlled, including through an independent Access Review Committee, which ensures that only approved individuals from approved institutions have access to the data. Approved researchers can only access the data within a Secure Research Environment for health research purposes and are not allowed to extract data from the library.

Secondary information

Type

Written question

Reference

79826

Session

2024-26

Related items

Deposited Paper DEP2025-0460
Monday, 7 July 2025
Deposited papers
House of Lords

Genomics: Data Protection
Monday, 12 January 2026
Written questions
House of Commons

Subjects

Data protection Genomics

Link

View this Written question on www.parliament.uk