All health and social care organizations in England must comply with this by September 2021 (delayed from original date due to the pandemic). This was based on a recommendation from the previous National Data Guardian.
Scotland, Wales and Northern Ireland have different policies.