Your Business Holds Sensitive Data. Can You Prove It's Being Used Properly?

A business may have a lawful reason to collect personal information and still need to ask whether every later use is appropriate. Customer records, employee files, identity documents and health information can spread across email, shared drives, line-of-business systems and supplier platforms. If someone asks who can see a record today, a policy statement is not enough: the answer should be based on current evidence.

The NHS story is about control as well as collection

A report described more than 44,000 people objecting to NHS England's use of its Federated Data Platform, a system intended to help organisations coordinate operational work. The objections focus in part on trust in the supplier and the handling of sensitive records. They are requests for the controller to consider, not a finding that records were improperly disclosed or sent to another organisation. NHS England has said suppliers act on its instructions and cannot use the data for their own purposes.

That distinction matters for any business buying a cloud service. A provider may host or process information without deciding why the business uses it. The organisation setting the purpose still needs to know what the contract permits, which other parties can handle the data and how the agreed safeguards work in practice. Outsourcing a technical task does not make the business's questions about purpose, access and accountability disappear.

Start with the purpose, not a consent checkbox

For each important information set, record what it contains, why it is needed, who is responsible for the decision to use it and which systems or suppliers handle it. The UK GDPR requires a suitable lawful basis, fair and transparent processing, and use for specified purposes. Consent is one possible lawful basis, not a universal requirement. If information is special-category data, an organisation generally needs both an Article 6 lawful basis and a separate Article 9 condition, along with any additional safeguards that apply.

Then test later uses against the purpose originally explained. A contact record collected to deliver a service should not quietly become a general source for unrelated analytics or AI experimentation. If the purpose changes, assess whether the new use is compatible, whether people need updated information and whether a data protection impact assessment is appropriate. Record the decision and its owner rather than relying on an undocumented assumption.

Technical settings should reflect the written rules

In Microsoft 365, groups, SharePoint permissions and guest-sharing settings can limit who sees a folder; identity and access reviews can help reveal accounts or privileges that should be removed. Audit logs can help investigate access and sharing, while retention labels and policies can support an approved retention schedule. Those features are useful only when somebody has configured them for the organisation's actual information, checked their scope and knows how to respond to the records they produce. A Microsoft 365 configuration does not, by itself, establish GDPR compliance.

Apply the same discipline to other business systems. Give staff only the access their role needs, separate routine user accounts from administration, review external sharing and remove access promptly when roles or supplier relationships end. Set a retention period for each record type, define who can approve exceptions and test whether deletion reaches copies and connected services where it should.

Evidence to request from your IT provider

Ask for current records, not only a security brochure. Depending on the system, useful evidence may include:

• A list of administrator, guest and supplier accounts, with an owner and reason for each.
• The date and result of the latest access review, including actions still outstanding.
• Relevant audit-log coverage and retention periods, plus an example of how a sharing event is investigated.
• The configured retention rules, the business owner's approval and evidence that disposal or exceptions are handled.
• Current processor and sub-processor details, data locations, contract terms and the process for responding to an individual's request.

Also ask which evidence is generated automatically and which checks require a person to act. A log that nobody reviews is not a completed review. If a provider cannot produce a tenant access list, agree who will create it, when it will be checked and how overdue actions will be reported.

A practical governance check

1. Choose one sensitive information set and name its business owner.
2. Document its purpose, lawful basis, location, supplier relationships and retention rule.
3. Compare those rules with actual accounts, permissions, sharing links and audit settings.
4. Remove unnecessary access and record who approved any exception.
5. Repeat the review after a material system, supplier or business-process change.

The useful test is not whether a policy exists but whether it describes the system people use today. If a customer asked exactly who could access their information today, could you prove the answer?

Sources and further reading

• The reported NHS Federated Data Platform objections
• ICO: Lawfulness, fairness and transparency
• ICO: Purpose limitation
• ICO: Special-category data
• ICO: Storage limitation
• Why training records need practical security controls