Security, Privacy & Legal Compliance
This lecture covers the second half of NHIC’s data governance journey: how access to sensitive health data is granted and recertified, how privacy obligations under DPPL No. 058/2021 are met, the security controls and incident response process protecting the data, how third-party risk is contained, and how metadata and lineage keep every dataset traceable. It closes with the key lessons from NHIC’s journey so far.
- Trace the four-step data access workflow and the quarterly recertification loop that keeps entitlements honest
- Summarise NHIC's privacy programme — lawful basis, consent, DPIAs, data subject rights, and 72-hour breach notification
- Walk the five-phase incident response cycle and the audit practices that back it with evidence
- List the contractual and operational controls applied to third parties before and during data sharing
- Explain how end-to-end metadata and lineage tracking supports purpose limitation and audit obligations
Data access and privacy
Access to NHIC data is granted on least privilege through a logged, role-based workflow, and all processing is anchored in lawful basis and consent.
The access workflow
Every request passes four gates, and every granted entitlement is re-examined on a quarterly cycle that loops back to the start:
The workflow is reinforced by five standing controls:
| Control | Purpose |
|---|---|
| Least privilege | Access is scoped to the minimum needed for the role |
| RBAC | Entitlements are attached to roles, not individuals |
| MFA enforced | Multi-factor authentication on all access |
| PAM | Privileged access management for administrative accounts |
| Quarterly recertification | Every entitlement is re-justified or revoked each quarter |
Privacy and consent
- A lawful basis is required for all processing — no processing happens by default.
- Consent is informed and documented.
- DPIAs are conducted for all high-risk systems.
- External sharing requires a Data Use Agreement before any data moves.
Data subjects hold four rights over their data: the right to access, rectification, erasure, and portability.
Breach notification. Reportable breaches are notified to the NCSA within 72 hours, as required by DPPL Article 46.
Discussion question. How do you manage access to sensitive health data — and what privacy and consent frameworks govern how that data can be used or shared?
Technical deep dive — access and privacy.
- RBAC vs. ABAC — what drove your choice for health data?
- How do you handle break-glass emergency access?
- How do you enforce purpose limitation technically, not just contractually?
- How do you operationalise data minimisation in systems built to capture maximum data?
- How do you manage consent at population scale?
Information security and audit
Layered technical controls and a structured incident response process protect the data, backed by evidence-driven compliance.
Security controls
| Control | What it covers |
|---|---|
| Encryption at rest and in transit | Data is encrypted in storage and on the wire |
| SIEM monitoring | Centralised security event collection and correlation |
| EDR / VPN / firewall | Endpoint detection and response, secured remote access, and network perimeter controls |
| Vulnerability and penetration testing | Regular technical testing of the estate |
Incident response
Incidents are handled through a five-phase cycle. Recovery feeds straight back into identification, because every incident sharpens detection for the next one:
Audit and compliance evidence
- Logs are retained for a minimum of 12 months.
- Formal ISMS and data governance internal audits are conducted.
- A Compliance Evidence Register is actively maintained.
- Incident response and BC/DR tabletop exercises are conducted.
- Compliance is demonstrated under the Ministry of Health’s Data Controller certification and NCSA obligations.
Discussion question. What information security controls protect your health data — and how do you demonstrate compliance to your regulatory authority?
Technical deep dive — information security.
- Encryption standards and key lifecycle management?
- How is your SIEM configured for health data — what events do you monitor?
- How do you balance audit log completeness with data minimisation?
- How do you approach zero-trust in a health environment with many integrations?
- How do you test incident response effectiveness?
Third-party and vendor risk
External access to NHIC data is contractually and operationally controlled from day one:
| Control | Requirement |
|---|---|
| Data Use Agreement | Required for every external data user before any sharing occurs |
| Quarterly risk rating | Vendor risk reassessed every quarter |
| Right-to-audit | Reserved for highest-risk vendors |
| Obligations confirmed pre-engagement | Vendor data protection obligations verified before engagement begins |
| Secure transfer | Defined secure transfer methods required |
| Defined retention | Retention periods set for all vendor-held data |
Discussion question. How do you manage data governance and security risks from third parties who access or process your health data?
Technical deep dive — third-party risk.
- What does your vendor due diligence checklist include?
- How do you enforce data use limitations technically, not just contractually?
- How do you handle cross-border data transfers?
- How do you ensure vendors notify you of incidents within your required timeframes?
- How do you manage secure data disposal when a vendor relationship ends?
Metadata management and data lineage
Every dataset is discoverable, traceable, and auditable — from origin to downstream use. Metadata is captured at collection and carried through every stage, with an audit trail recorded end to end:
Tracking metadata and lineage end-to-end is what makes purpose limitation enforceable and audit obligations answerable: for any downstream use, NHIC can show where the data came from, how it was transformed, and under what basis it is being used.
Discussion question. How do you manage metadata and track data lineage — and how does this support your governance and audit obligations?
Technical deep dive — metadata and lineage.
- What metadata schema do you use and how do you enforce consistency across systems?
- What cataloguing tool do you use and how do you keep it current?
- How do you implement end-to-end lineage across ETL pipelines?
- How do you use lineage records to support breach investigations?
- How do you manage metadata for derived or aggregated datasets?
Key lessons learned
What NHIC’s journey has taught so far — offered as talking points, not conclusions:
- Approval is everything — policies without authority are just documents.
- Data classification must come first — it unlocks everything else.
- Roles must be named, not just defined.
- Governance is cross-functional — IT, legal, compliance, and leadership must all be involved.
- Build your evidence register from day one.
- Train people before deploying tools.
Open discussion question. What is the single most important lesson from your data governance journey — and what would you do differently if you were starting again today?
Final open technical discussion.
- How do you govern data in federated or multi-institution health systems?
- How do you balance openness for public health research with individual privacy?
- How are you approaching AI and machine learning governance on health data?
- What is your biggest blocker on your governance maturity roadmap?
- Which governance or security tool has delivered the most value?
Where to go next
Revisit Governance Framework, Classification & Quality for the framework these controls hang off, or return to the sub-module overview.