Supporting the secondary use of health data in Cyprus
The Cyprus Health Data Access Body (HDAB) is being established to enable the lawful, secure, and transparent secondary use of health data. As the national coordinating body, it will support data access processes, governance, and secure data services within the Cyprus health data ecosystem.
Key responsibilities
HDAB staff and participating institutions will support:
-
Managing and reviewing data access applications
-
Assessing requests and coordinating decisions
-
Issuing and monitoring data permits
-
Communicating with data users and data holders
-
Managing the national health dataset catalogue
-
Maintaining the metadata and data quality information
-
Coordinating secure data preparation and analysis
-
Keeping audit logs and operational records
-
Supporting cross-border collaboration through HealthData@EU
The HDAB workflow
1. Application submission
Applications are received and registered through the Data Access Application Management System, where initial eligibility and completeness checks are performed.
2. Request assessment
Applications are evaluated based on:
-
Public interest and expected benefits
-
Legal and ethical compliance
-
Data minimisation principles
-
Privacy and security safeguards
-
Dataset suitability and feasibility
3. Coordination with data holders
HDAB collaborates with relevant data holders to verify data availability, quality and preparation requirements.
4. Decision and permit management
Following assessment, requests may be approved, amended or rejected. Approved requests receive the appropriate data permit or authorization.
5. Secure data processing
Approved datasets are prepared within secure environments, ensuring access is restricted to authorised users and approved purposes only.
6. Monitoring and closure
All activities are logged and monitored. Access is terminated when permits expire, and records are retained in line with governance requirements.
Governance principles
HDAB operations are guided by:
-
Lawfulness and accountability
-
Purpose limitation
-
Data minimisation
-
Fairness and consistency
-
Security and confidentiality
-
Transparency and traceability
-
Privacy by design
-
Data quality and usability
Note: The final roles, procedures, and operational arrangements of the Cyprus HDAB will be defined through the applicable legal and governance framework.