United Kingdom
Last reviewed: 2026-09-26
A UK healthcare review needs to consider UK GDPR, the Data Protection Act 2018 and duties of confidentiality. NHS work can add procurement and clinical-safety requirements. Masking does not replace those decisions.
Where PHI Mask fits
Your file is masked in your browser and never sent to us. The Compliance page explains the masking workflow, browser storage and the separate handling of website and support information.
The service you send a masked copy to has its own purposes, settings, contracts and storage locations. Assess that service as part of your workflow.
Identify the lawful basis and health-data condition
Record an Article 6 lawful basis and an Article 9 condition for health or other special-category data. Some conditions also require a Data Protection Act 2018 Schedule 1 condition. Consider confidentiality obligations alongside data protection law.
Describe the task, who will use the information and which service will receive it. Do not treat a general agreement to care as permission for every new use.
Assess whether a person can be identified
A masked copy can remain personal data when someone can identify the person, including through a recovery mapping or the remaining context.
Control access to that mapping and keep it out of submissions to the selected AI service.
Review the workflow and its recipients
Use a DPIA where processing is likely to create a high risk to people. Assess the device, local recovery information and selected AI service together.
Determine processor-contract requirements and whether overseas access creates a restricted transfer. Use UK transfer requirements for the UK assessment.
Check NHS deployment requirements
For NHS work, involve the adopting organisation's privacy, IT security and clinical-safety leads. Establish which assessments and approvals the intended use needs. NHS England publishes DTAC guidance for buyers and suppliers in England; other UK health services have their own processes.
This page does not establish NHS approval, a completed DTAC assessment or compliance with a clinical-safety standard.