Skip to content

ACCA Strategic Professional · Strategic Business Leader · Big data and data analytics

Calder Health, a hospital group, wants to share patient records with a university for analytics research. The board asks how to reduce data protection risk while still allowing useful analysis. Which action is MOST appropriate?

The most appropriate action is to anonymise or pseudonymise the records, restrict access to what the research requires, and formalise a data sharing agreement. This applies data minimisation and accountability, reducing privacy risk while still enabling useful analysis.

  1. AAnonymise or pseudonymise the records, limit access to what the research needs, and put a data sharing agreement in placeCorrect
  2. BShare the full identifiable records, because research is always exempt from data protection rules
  3. CDelete all patient data so that no analytics can take place
  4. DShare the data and rely on the university's own policies without any agreement

Explanation

Data minimisation, anonymisation or pseudonymisation, controlled access and a formal agreement reduce risk while preserving analytic value. Research is not a blanket exemption, and deleting everything is disproportionate.

Did you get it right without looking?

One question tells you little. A timed set on Big data and data analytics shows your real accuracy, how long you take and where you lose marks.

Practise Big data and data analyticsFree diagnostic mock

More Big data and data analytics questions