Under the General Data Protection Regulation 2016 (GDPR), NHS Digital is the controller of your personal data where we are directed or requested to process personal data for COVID-19 purposes. We are also a joint controller with the person who has directed or requested us to do this work. This may be the Secretary of State for Health and Social Care, NHS England or an NHS body in Scotland, Northern Ireland or Wales.

Where we share data, NHS Digital is usually the sole controller, unless we have been directed to share the data by the Secretary of State or NHS England, in which case we will be joint controllers.

Where we are directed to process personal data for COVID-19 purposes, this is a legal obligation and we are allowed to do this under Article 6 (1)(c) of GPDR. 

Where we process personal data as part of our statutory functions, including where requested by other bodies, for example. by the NHS in Scotland, Wales or Northern Ireland, this is part of our public task. We are allowed to do this under Article 6(1)(e) of GDPR. 

Where we need to process health data and other special categories of personal data, we will only do this where it is necessary as part of our statutory functions. Under GPDR we are allowed to do this where it is necessary for substantial public interest reasons (Article 9(2)(g)), where it is necessary for healthcare purposes (Article 9(2)(h)), where it is necessary for public health purposes (Article 9(2)(i)) or where it is necessary for scientific research or statistical purposes (Article 9(2)(j)).

We are also allowed to share your personal data under GDPR where it is necessary for us to do so for one of the purposes explained above.

More information can be found in the Who we share your data with section. 

The types of personal data we may process in response to COVID-19 include:

• demographic data – your name, date of birth, sex, NHS number and your contact details such as your address, telephone numbers and email address
• health information – information relating to your health and the care you have been provided - this may include information about medical conditions, treatments, prescription information, care episodes, hospital admission and discharge information, test results, including tests relating to COVID-19, information on whether you are self-isolating
• information collected as part of our online services which we need to help maintain the security and performance of our website and also to help us understand how our services are used so that we can make improvements. This may include information such as your IP address, technical log events, the type of browser you’re using and the actions you took when using these services

We will only process the minimum data necessary to achieve our purposes.

Collecting personal data from you directly

We may collect personal data from you directly, in which case we will tell you at the time the purposes for which we will use your data in a privacy or transparency notice.

Examples of where we have done this for COVID-19 purposes are the Isolation Note Service and the service to Get text messages from the NHS about coronavirus. We will not collect more information than we require, and we will ensure that any personal data collected is treated with the appropriate safeguards.

Collecting personal data from other organisations

We may also collect personal data from other organisations, including health and social care organisations, for example from Public Health England, NHS Trusts, GP Practices, Local Authorities, NHS England, the Department of Health and Social Care and other government departments.

Usually we do this by issuing the organisation with a Data Provision Notice. This requires or requests those organisations to provide us with data where this is necessary for us to perform our functions under the Health and Social Care Act 2012.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. 

The Health Service (Control of Patient Information) Regulations 2002 allow confidential patient information to be used and shared appropriately and lawfully in a public health emergency and are being used during this outbreak.

Using these regulations, the Secretary of State has issued legal notices requiring NHS Digital, NHS England and Improvement, Arms-Length Bodies (such as Public Health England), local authorities, health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use patient information.  

We will only retain your personal data for as long as is necessary for the purposes for which we obtained it and in accordance with the following: 

NHS Digital only stores and processes your personal data within the United Kingdom.

Fully anonymous data, for example, statistical data, which does not allow you to be identified, may be stored and processed outside of the UK. Some of our Processors may process your personal data outside of the UK. If they do we will always ensure that the transfer outside of the UK complies with data protection laws.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information, and what choices and rights you have, see How we look after your health and care information and our General transparency notice.

We may make changes to this transparency notice. If we do, the date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.