Care operations need visible, enforceable boundaries

List the information categories the proposed workflow would handle and where each would enter, appear and leave the system. Include copies such as files, exports, audio and generated text where relevant.

Ask which organisation is responsible at each stage and what written terms explain the arrangement. The ICO's controller-and-processor guidance is a starting point; the answer depends on the actual relationship.

Official context: ICO: controllers and processors

Ask to see the same fictional task through different roles: someone who can view, someone who may change it and someone who should not have access. Then ask how access is reviewed when a person changes role or leaves.

The ICO describes authorised access and suitable security controls as part of protecting information. Request evidence for the identities, records and actions your service intends to use.

Official context: ICO: security outcomes

Include an unavailable service, lost device and accidental change. Ask what the user sees, which contact route applies and what the organisation needs to do while the issue is handled.

Keep backup, recovery, retention, deletion and export questions separate. A backup is not a user-accessible export, and a stated objective is not a completed test. Ask for scope, date and limitations.

The ICO explains that security measures should reflect the risks involved. Ask how the proposed service handles your intended information and use, rather than relying on general language.

Before operational use, obtain agreed processing terms, supplier and location information, access arrangements, support process and any assurance evidence material to your decision.

Official context: ICO: a guide to data security