Secure data environments provide a safe and controlled way for approved users to access health data. They keep data protected while supporting research, planning and analysis that benefit the health and well-being of patients and communities across NSW.
A secure data environment (SDE) is a protected virtual space where health data can be stored, accessed, and analysed safely. It uses strong security controls to keep the information private and prevent misuse.
SDEs are also known as trusted research environments (TREs), clean rooms or digital research environments (DREs), and have previously been called secure access environments (SAEs).
SDEs bring data and analysis tools together in one protected location. Approved users complete their work inside the environment, and the granular data stays there. When ready, users can then bring out their results in a summary form via a door (gateway) that is monitored and requires extraction approvals.
A short video from NHS UK explains the concept:
A secure data environment is required when a Five Safes assessment of a request for data held by NSW Health identifies:
NSW Health has established Minimum Requirements for Secure Data Environments. These requirements are technology-agnostic and designed to ensure best-practice data security and governance across five key areas:
To be listed as meeting NSW Health requirements, an SDE provider completes a review that shows how their environment aligns with NSW Health’s minimum standards. This review considers documentation and evidence to confirm that key privacy, security and governance principles are in place
NSW Health is currently in the process of reviewing a number of SDEs to determine whether they meet the NSW Health minimum requirements for an SDE. This page will be updated as soon as any SDE completes the review process and is confirmed to meet the NSW Health minimum requirements.
For now, organisations and researchers should continue using their existing approved environments.
Statistical analysis, machine learning, data visualisation, natural language processing, and other analytical tasks using approved tools.
SDEs enforce governance rules through technical and procedural controls, provide comprehensive audit trails, and reduce the risk of unauthorised data sharing.
Contact moh-datagovernance@health.nsw.gov.au for guidance on SDEs, the assessment process or requirements.
While there are many examples of SDEs being used to safely share NSW Health data, and the number is increasing over time, two examples of programs currently enabling projects of public benefit using SDEs are:
No. Listing reflects that the provider met minimum requirements based on evidence submitted at the time of review. It is not certification or endorsement by NSW Health.
NSW Health will review the SDE and may remove them from the list if requirements are not maintained.
University Researcher analysing specific health data.
A university PhD student is using emergency department data for their thesis.
A consultant evaluating health service performance using patient records.
A NSW Health clinician conducting personal research outside their role as part of an approved research team.
Access is available to approved users who meet governance and ethical requirements. Typical users, for example, could include researchers, consultants, universities, government agencies, charities/NGOs, students under supervision, etc.
Approved users can choose their own SDEs and discuss with the provider how their requirements are met, and if costs and governance are appropriate. The environment within which data will be stored and analysed must be defined in the approved study protocol. The SDE included can be chosen from the listed SDEs on this page.
Yes. Research conducted outside your NSW Health role requires the use of an SDE that meets NSW Health requirements, even if you're employed by NSW Health.
No. Individual-level data cannot leave the environment. Only approved, aggregated outputs that have passed disclosure control checks can be exported.
Before accessing SDE, users must complete mandatory privacy and security training. This training covers key areas such as privacy obligations, security protocols, data handling, output review, and incident reporting. Specific requirements may vary by SDE provider, so check with your chosen provider for details.
This varies by SDE provider and depends on the completeness of your application, approvals and training. Contact your chosen provider for their timeline.
Most SDEs provide multiple analytics software. Some may allow bring your own licensed software at their discretion if it doesn't compromise security. Check with your provider.
Projects that are assessed as requiring an SDE, must use an SDE. There are only limited instances when a data disclosure decision maker may consider disclosure to an environment other than an SDE. Examples of projects where the ADO may agree that an exception is warranted following a Five Safes assessment, include:
If an SDE is not feasible, meaning there are no available SDEs within which the data could be analysed, the requestor must provide supporting information to the relevant data disclosure decision maker to consider. The requestor must sufficiently demonstrate that an SDE cannot be used, and that the alternative environment has been reviewed by appropriately qualified persons (e.g. NSW Health Cyber-Security and Enterprise Architects) and is compliant with NSW Health guidance, policies and legislation.
Check the list of assessed providers on this page. If not listed, the provider must complete the assessment process first.
Yes. SDEs that meet NSW Health requirements support data custodians (or trusted delegates) loading data directly through secure gateways.
Confirm data disposal per retention policies, request disposal confirmation, review final outputs where appropriate, and update your records.
Data retention should be determined at the start of the project and documented within the approved study protocol. Retention periods are not fixed for all projects. They depend on multiple factors, including requirements under the State Record Act, national research guidelines (NHMRC), institutional research/data governance policies, Human Research Ethics Committee (HREC) endorsement and any specific legal or funding conditions.
Retention may be extended if required by legislation, funding arrangements, or other compliance obligations.
Typically 12+ weeks depending on submission completeness and complexity.
Our requirements are technology-agnostic. Demonstrate how you meet the principles and standards regardless of specific technology choices.
Yes. If your environment changes significantly, notify NSW Health and you may need to submit updated evidence.
Maintain adherence to requirements, notify NSW Health of material changes or incidents, participate in periodic reviews, and provide required reporting.
Yes. An agreement must be signed after a successful review before your SDE can be listed on the NSW Health website.
Input and output checking are controls used in SDEs to manage what data enters and leaves the environment.
Input checking ensures that data loaded into an SDE is approved, appropriate for the project, and transferred safely through a secure gateway.
Output checking ensures that the results leaving the SDE do not contain identifiable or disclosive information. Only approved outputs - such as aggregated tables, statistics or graphs can be released.
Output checking is typically performed by authorised reviewers(for example, a human reviewer or a designated output checker) following documented rules and approvals. Automated tools may support the process, but human review is required where there is a risk of re-identification.
The specific approach to input and output checking may vary between SDE providers but all reviewed environments must demonstrate that appropriate checks are in place to protect privacy and reduce disclosure risks.
Some of the security standards include ISO 27001, IRAP, eHealth NSW PSAF, ASD Essential Eight, NIST SP 800-37, and other recognized standards. See the requirement document for the complete list.
Break-in testing ensures external threats can't access data. Break-out testing ensures data can't leave unauthorised. Both are critical for SDEs.
Infrastructure and data must be hosted in Australia. Remote access from overseas may be permitted under strict controls documented in the Data Disclosure Agreement between the project lead and NSW Health.
Data must be encrypted at rest and in transit using strong encryption (for example, AES 256-bit minimum) with carefully managed encryption keys.
SDEs are becoming standard across Australian jurisdictions. Costs vary by provider and depend on factors such as the number of users, performance requirements, and software needs. Most providers offer flexible pay-for-what-you-use models, so projects only pay for the resources they need.
To manage costs:
Many SDE providers offer volume discounts or negotiated pricing for larger or longer-term projects. Discuss your needs with providers.
Whether you're a researcher, data custodian, or SDE provider, our team is here to support you. Email moh-datagovernance@health.nsw.gov.au.
