Data Governance Portal

The existing process for granting access to the main database relied on several systems and manual steps. Users submitted their requests through a web survey, the requests were collected into a CSV once a day, and the file then had to be manually uploaded to the data platform before a script could process each request. Non-sensitive datasets could be approved automatically, while sensitive datasets required a human approver. This created several problems: requests could be delayed by the daily processing cycle, manual uploads introduced opportunities for errors, and administrators had no single place to see who had access to which datasets or track requests. Changes to datasets and approval rules also required manual script changes, while different naming conventions between the front-end and database added further complexity. UKHSA's goal was therefore to replace this fragmented workflow with a single web application that could manage the entire process, from submitting an access request through to approval, database updates, and eventual access revocation.

We began by understanding the existing access process and the issues UKHSA wanted the new system to solve. We mapped out the journey from submitting an access request through to approval and database updates, then used this to define the core features and workflow of the portal. Throughout development, we held weekly Zoom meetings with the UKHSA clients to demonstrate progress, discuss requirements, gather feedback, and make changes based on their priorities. We iterated on both the user interface and underlying workflow, particularly around automatic approval for non-sensitive datasets and a dedicated dashboard for sensitive requests requiring human approval. This regular collaboration helped us build the solution around the client's actual process rather than making assumptions about how the system should work.

The full access process now runs through one web application. Users log in, submit requests, select datasets and access types, confirm their training, and track request status, with no separate surveys or manual CSV uploads required. A rules engine handles non-sensitive datasets automatically, while sensitive requests are routed to an approver dashboard where they can be reviewed, approved, or rejected with a reason. The system then updates the relevant database records as part of the workflow. Alongside the functionality, we focused on making the portal straightforward to use and appropriate for a government-facing environment. We introduced dark and light themes, used a colour palette influenced by the GOV.UK design language, and built consistent CSS components across forms, dashboards, tables, and approval screens. The result was a solution that addressed both the underlying process problems and the usability of the people interacting with it.

We completed the portal and demonstrated the finished product to the UKHSA clients, walking them through the full access request and approval workflow. The system met all of the specifications provided to us, including automated handling of non-sensitive requests, approval workflows for sensitive datasets, and centralised management of access. We also went beyond the initial requirements by implementing additional security features such as email and phone number verification. The clients were happy with the final result, and the project gave us practical experience of working with a real client, responding to feedback, and delivering against a detailed set of requirements.