SHIP assigns privacy risk category

Understanding SHIP's proportional authorisation process

There are 5 key elements of risk which SHIP will use to assign a privacy risk category to a researcher’s data access request in light of your proposed approval of this request, including any conditions for access that you may have set. Each of these will be given due consideration in any risk assessment. They are:

  1. Privacy (the likelihood of breach)

  2. Impact of any privacy breach

  3. Reputational impact for data controllers

  4. Research motive

  5. Public expectations including the public interest in your research project

Alongside these risks, 5 core concerns must also inform any privacy assessment, in essence any relevant considerations pertaining to the application will fall under the following 5 concerns and thus they should be kept in mind at all times :

  1. Public interest- is there a public interest in your research project?

  2. Safe data- is the data you propose to access safe and secure, e.g. has it been or can it be anonymised?

  3. Safe people- have you attained SHIP approved research status?

  4. Safe environment- is a SHIP Safe Haven being used? Or if there is to be data travel are adequate security measures in place?

  5. Relative risks- what are the risks associated with your proposed data access? What measures could be taken to combat these risks?

After these core elements of risk and concern have been assessed, the application will be given a privacy risk category. The fewer concerns that are raised by the proposed data access and use the lower the privacy risk category that will be assigned to the access request.

Opportunity to influence risk categorisation

Both you as data controller and the researcher can alter the category that is assigned to the access request by, for example, requesting the use of non-disclosive and non-sensitive data only, or by specifying that a SHIP Safe Haven must be used to access the data.

Consequences of risk categorisation

The consequences of an application being assigned a particular the risk category assigned are:

  • This determines the authority responsible for authorising the data use.  For categories 0 and 1 approval will be given by SHIP without the need for further review, for category 2 a ‘fast track review’ will be conducted by the national Privacy Advisory Commitee (PAC), and for category 3 a full review will be conducted by PAC.

  • The lower the risk category,  the more likely it is that the researcher will be granted data access and that access will be granted quickly.

  • The lower the risk category, the fewer the additional conditions that may be attached to the data use.

These are summarised in the following table:

SHIP Triage Classification Table

Return to top of page

Return to route map