This is the tool used by the NHS to assure itself that its organisations, and those it works with, have secure and legally compliant systems and processes for handling the large amount of sensitive personal data that they deal with daily.