Authorisation criteria - regulators

[peterkwells]

Describe the problem, gap or error in the framework
The authorisation criteria state that "the regulator for....where they involve personal information has been identified". This risks focussing information toward data protection regulators when the data involved may not be personal (for example data could be anonymised to a legal definition which excludes it from data protection) and/or another regulator, such as one for medical devices may be more appropriate.

Describe alternatives you've considered
Suggest altering the text to include the possibility of multiple regulators and indicate the need for health/medical expertise.

Additional context
In the UK the MHRA and ICO would be two of the regulators involved.

[ellenbroad]

@peterkwells agreed. Will update and share back here.