Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, who has custody over the encryption keys used to protect data held within the NHS Federated Data Platform and the Privacy Enhancing Technologies.

NHS England owns the keys. The Privacy Enhancing Technology (PET) software generates, controls, and stores the key values securely, so they are not accessible to human users.

The use of encryption keys is strictly controlled by NHS England for the NHS Federated Data Platform (NHS FDP) tenant and by the data owners of local tenants.

Both the NHS FDP and PET contracts are based on Government Legal Department terms and conditions, aligning to best practice in respect of cyber security and security management, which is reflected in the redacted versions of the agreements available on Contracts Finder.

The contract terms reflect and support the management of encryption keys as set out above, where specific requirements relate to encryption keys this would be included in the specifications of the contracts. Both agreements have terms which ensure enforcement of United Kingdom legislation and regulatory requirements in relation to data processing. For reference, the NHS FDP contract can be found at the following link:

https://www.contractsfinder.service.gov.uk/Notice/0f8a65b5-23a2-4294-abb1-a7fd8efb3ad0

In addition, the NHS England PET contract can be found at the following:

https://www.contractsfinder.service.gov.uk/Notice/2fa49293-bc01-4e0f-a017-f01cb0195212