Retained implementation research

At the 3 November 2026 baseline, Scotland's Care Reform sections 2–7 remained prospective, while Northern Ireland's 2016 data-processing Act was in force with its statutory approval machinery still pending. Those positions limit the digital-sharing requirements or approval routes that can be attributed to the reforms. ^{111, 084, 085}

This page is the dated evidence appendix behind the Scottish and Northern Irish accounts. The Scottish check concerns digital care records and future sharing/standards arrangements. The NI check concerns approval for uses beyond individual care. Their different legal effects are explained below, followed by the supporting implementation chronology and reopening triggers.

For a current obligation, begin with the requirements table and relevant national chapter. Use this record to inspect why a reform is or is not treated as an operative source of authority; existing powers, contracts and lawful routes retain their own scope.

Scotland: digital care records and future instruments

The Care Reform (Scotland) Act 2025 received Royal Assent on 22 July 2025. Part 1 provides a framework for records, sharing schemes and standards. Its potential standards scope includes public bodies, independent healthcare, primary care contractors and relevant technology suppliers. Enactment and commencement are different steps. ⁰⁶³

At 3 November 2026, the official revised legislation records sections 2–7 as prospective: not yet in force. This replaces the initial research gap with a supported, dated status conclusion. Section 1's ministerial digital-record duty is already in force. ¹¹¹

SSI 2025/388 expressly commences sections 1 and 24. It does not commence sections 2–7. ⁰⁶⁴ The revised Part 1 XML marks each of sections 2–7 Prospective. The complete official effects table contains 60 rows and identifies no later commencement instrument for those sections. Only the Act itself and SSI 2025/388 appear as affecting instruments. ^{111, 112}

Schemes, standards and implementation checks

The check also covered official instrument title and full-text searches, Scottish Government updates and parliamentary material. No section 2 scheme, section 5 civil-sanctions regulations or section 7 website-domain regulations were identified. This is a bounded negative finding supported by explicit prospective status, rather than a claim based only on missing search results. Editorial delay remains possible; recheck when a new instrument or standard is published. ¹¹²

The explanatory notes identify website-domain regulations as a necessary implementation step after section 7 commences. A document called a preferred standard or technical specification does not, by its title alone, become a statutory standard under this framework. ¹¹³

The August 2026 Data Board minutes describe proposed standards governance and transition arrangements. Those organisational plans do not themselves activate sections 2–7. ¹¹⁴ The Government's September 2026 response anticipates phased delivery of a national digital care record over five to ten years, with an outline business case by summer 2027. These are programme expectations, not statutory commencement dates. ¹¹⁵

Existing powers, directions, agreements and contracts still need separate assessment. The prospective position does not suspend established lawful sharing or make every existing Scottish standard optional. Record the actual instrument and purpose for each proposed exchange. Reopen the dated implementation check in the validation queue when new official evidence changes this position.

Northern Ireland: secondary-use machinery

Position checked on 3 November 2026: the 2016 Act is in force. Its proposed statutory approval machinery remains pending on the official record reviewed. This conclusion combines direct departmental evidence with later ministerial answers and current legislative registers; it is not based only on an unsuccessful search. ^{084, 085, 121, 122, 127}

Commencement is distinct from implementation

The Act received Royal Assent on 11 April 2016. Section 6(2) brought it into operation the following day, 12 April 2016. A further commencement order is therefore not the missing step. Sections 1 and 2 require regulations for prescribed processing and the statutory authorisation committee. Section 4 requires Assembly approval of draft regulations. Section 3 provides for a statutory code. These provisions do not themselves give a project a completed approval route. ⁰⁸⁴

The official revised XML and effects register show three recorded effects: two Data Protection Act 2018 changes and a 2022 HSC organisational modification. No 2026 amendment appears in that register. Its current text still contains the original relevant-person definition which officials proposed to repair. ^{084, 121}

What the implementation record establishes

• On 12 February 2026, the Minister described the implementing regulations and replacement statutory code as future work. The answer identifies the existing confidentiality code and rejects the idea of a single standalone departmental policy authorising secondary use. ¹²⁶
• On 26 March, officials explained the defects and unfinished regulations, statutory committee, statutory code and regional opt-out. The proposed repair concerns historical/deceased service-user information and related definitions. ⁰⁸⁵
• The June ministerial answers still described a proposed amendment Bill subject to Executive processes and the Assembly timetable. They gave different projected timings; neither records actual introduction or enactment. ^{123, 124}
• The official record for a further introduction-date question tabled on 8 September contains no answer date or answer text when retrieved on 3 November. An unanswered question supplies no new ministerial assurance. ¹²⁵
• The Assembly's current Bill tracker contains no data-processing amendment Bill entry. The Health Committee's published delegated-legislation tracker likewise contains no implementing rule. These indexes corroborate the pending position; their publication coverage must remain visible. ^{122, 127}

The existing Privacy Advisory Committee guidance must not be confused with the statutory committee and code contemplated by the 2016 Act. Continued publication of the existing code supplies confidentiality guidance, not a new statutory approval. ^{126, 128}

Consequence for an organisation

A public HSC body or commissioned independent provider should not describe the intended 2016 mechanism as an approval it can already obtain. A proposed secondary use still needs its own organisational authority, data-protection basis and confidentiality justification under the available law. England's section 251/CAG route does not automatically supply Northern Ireland authority. ^{083, 084, 126}

This resolves the baseline status check to implementation pending on the published official record. Publication lag remains a limit: the Bill tracker labels proceedings as at 14 October, while also containing a 19 October entry. Reopen the record when an introduced Bill, enacted amendment, approved regulation, statutory code or explicit later departmental implementation notice appears. No recurring monitoring is scheduled. ^{122, 127}

Return to Scotland, Northern Ireland, planning, research and public health or how to read a digital requirement.