NEUVIOR Third Party Data Responsibility Standard

A NEUVIOR authored public governance principle.

It is not a national, regulatory or certification standard. Use it to keep data responsibility visible when hosting, software or services are entrusted to another organisation.

Published by NEUVIOR · 2 August 2026 · Version 1.0

See what must be established

Read about all standards

Outsource infrastructure. Never make responsibility disappear.

• NEUVIOR treats external hosting, software and service providers as part of the operating system, not as responsibilities outside it.

• The purpose of processing, legal role of each party, applicable lawful authority, binding instructions and contractual responsibilities should be established before sensitive information is entrusted to a supplier. Applicable law, regulation, professional duties, mandatory standards and binding contracts prevail.

Purple network patch cables connected to labelled rack ports, with blue cabinets and a person farther along the aisle. — Illustrative stock photography of network equipment and a person in a server-room aisle. This is not a NEUVIOR facility, employee or depiction of the company’s infrastructure or security controls.
JuiceVerve · Server Room Technician Inspecting Network Cables Envato Elements commercial licence
Source and image notes
Full frame retained; EXIF orientation honoured, proportionally resized and encoded as WebP. No crop, creative colour grading, compositing or generative changes.

Purpose and legal role assessment

Determine whether each party acts as a controller, joint controller, processor or in another role for the specific processing operation, and record the duties that follow.

Governance

Supplier responsibility

A hosting, software or service provider may occupy different legal roles in different contexts. Define its instructions, safeguards, evidence and incident responsibilities without assuming one category.

Delivery

Third-party accountability

Can responsibility still be followed beyond the supplier?

A supplier relationship changes who performs work without making the underlying duties disappear. Trace purpose, supplier access, incident decisions and exit across the relationship. The selectable lenses expose questions for an actual agreement; they do not classify every supplier’s legal role or establish verified NEUVIOR security performance or custody of health data.

Third-party accountability

Editorial decision model, not measured NEUVIOR results.

Map the relationship before information moves

The first lens asks whether purpose, access and responsibilities are explicit before material is entrusted to a provider. ICO guidance supplies accountability context and is marked as under review. The actual legal position and relevant advice must be considered for the intended processing arrangement.

Identify the parties, purpose and complete access chain.

In focus

Purpose and roles

Establish the processing purpose and each party’s legal role for the specific activity. A supplier can occupy different roles in different contexts. The responsible organisations need to identify applicable authority, instructions and contractual responsibilities without assuming that every hosting or software provider belongs to one category.

Allocate the permitted work

Evidence to keep in view

Specific operation, legal-role assessment and accountable parties.

A useful next step

Who determines the purpose and who acts on whose instructions?

A supplier can perform work while each accountable organisation retains the duties attached to its own role.

ICO (n.d.), Contracts and data sharing NEUVIOR (2026), Third Party Data Responsibility Standard, version 1.0

Subprocessor and wider supply chain

Where subprocessors or subcontractors are used, keep them visible in the contractual, access, location, assurance and exit chain.

Extended supply chain

The accountable organisations should establish:

• The answers should be defined, approved and retained in the relevant legal, governance, security and operational records.

An external perspective

Useful does not mean unrestricted.

The IPO’s workplace introduction prompts a practical check before third-party material enters a product, analysis or publication: what permission covers this intended use?

Watch with these questions in mind

Identify whose material is involved before it becomes part of an output.
Check the permitted use rather than assuming availability grants permission.

IP BASICS: How do I avoid infringing IP in work?

Intellectual Property Office UK22 January 20161 min 11 sec

Choosing Watch loads YouTube’s player. No player or preview is loaded before then.

Published in January 2016. Use current IPO guidance and the actual licence when reviewing a specific reuse decision.

Intellectual Property Office (2016). IP BASICS: How do I avoid infringing IP in work? [Video]. YouTube. Accessed 20 October 2026.

Current IPO guidance: Using somebody else’s intellectual property. Film linked by Intellectual property made easy.

Published by Intellectual Property Office UK. Included as an external educational reference; no endorsement of NEUVIOR or PHARMORIS is implied.

Information and location

what categories of information are involved and where they are stored;

Access chain

which individuals, systems and subcontractors may access them;

Monitored activity

how access and privileged activity are monitored;

Detection and escalation

who detects, investigates and escalates abnormal activity;

Evidence and affected parties

how evidence is preserved and affected parties are identified;

Notification responsibility

who owns regulatory, contractual and individual notification responsibilities, subject to applicable law and each party’s legal role;

Continuity and recovery

how continuity, recovery and essential information availability will operate; and

End of relationship

how information can be securely returned, transferred or deleted when the relationship ends.

Outsourcing infrastructure does not outsource responsibility.

• Controllers, processors and other accountable parties retain the duties attached to their roles. A contract should allocate work and information flows clearly; it cannot erase a statutory duty.

• This principle does not determine the legal role or lawful basis for a particular processing operation and is not legal, data protection or security advice.

• The ICO material linked below provides wider accountability context. Accessed 2 August 2026, the ICO marks this material as under review following the Data (Use and Access) Act. Readers should check current official guidance and context specific advice. The link does not endorse NEUVIOR, certify any supplier or make this a regulatory standard.

Before the relationship

Map roles, information flows, locations, subprocessors, safeguards, evidence and approval conditions.

During the relationship

Monitor access, material changes, abnormal activity, incidents, continuity and the evidence needed for accountable decisions.

At exit

Evidence return, transfer, permitted retention and secure deletion across active systems, backups and relevant derived copies.

Read the ICO’s wider accountability context

This principle is not a security certificate or operating claim.

• This standard describes a governance principle. It does not indicate cybersecurity certification, regulatory approval, NHS deployment, customer adoption or independently demonstrated security performance.

• Publication is not evidence that NEUVIOR holds health data or has implemented, audited or independently validated this principle in an operating service.