A Health Data Access Body (HDAB) is a designated authority that reviews and authorizes requests to reuse health data for approved purposes, such as research, public health, or policy. It assesses whether a proposed use meets applicable rules and may issue a permit with limits on the data, purpose, and duration of access.
In cyber security, an HDAB is part of the authorization and accountability chain for sensitive health information. Its decisions help ensure that access is purpose-limited rather than open-ended, while permits and records can support auditing. Approval alone does not make processing safe: organizations must still enforce identities and permissions, monitor activity, protect secure processing environments, and control data exports. In practice, an HDAB’s review governs who may use data and why; technical safeguards help ensure they do so only as authorized.