Privacy notice

As data controllers, GPs have fair processing responsibilities under the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). This means ensuring that your personal confidential data (PCD) is handled in ways that are safe, transparent and what you would reasonably expect. Please find documents and links below.

Data Protection Privacy Notice for Patients


This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you. This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

  • Who we are, how we use your information and our Data Protection Officer
  • What kinds of personal information about you do we process?
  • What are the legal grounds for our processing of your personal information (including when we share it with others)?
  • What should you do if your personal information changes?
  • For how long your personal information is retained by us?
  • What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998). For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), and the Data Protection Act 2018 (currently in Bill format before Parliament) the practice responsible for your personal data is Royal Primary Care.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

 How we use your information and the law.

Royal Primary Care will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you  may include the following information;

  • Details about you, such as your address, carer, legal representative, emergency contact details
  • Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
  • Notes and reports about your health
  • Details about your treatment and care
  • Results of investigations such as laboratory tests, x-rays etc.
  • Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

 How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with: – Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost effective treatments.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 2018
  • The General Data Protection Regulations 2016
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality, Information Security and Records Management

Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Royal Primary Care an appropriate contract (art 24-28) will be established for the processing of your information.

In Certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. If some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – Royal Primary Care will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information to

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.

Where do we store your information Electronically?

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union. No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

  • NHS Trusts / Foundation Trusts
  • GP’s
  • NHS Commissioning Support Units
  • Independent Contractors such as dentists, opticians, pharmacists
  • Private Sector Providers
  • Voluntary Sector Providers
  • Ambulance Trusts
  • Clinical Commissioning Groups
  • Social Care Services
  • NHS England (NHSE) and NHS Digital (NHSD)
  • Local Authorities
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services
  • Voluntary Sector Providers
  • Private Sector Providers
  • Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required. We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for Royal Primary Care an appropriate contract (art 24-28) will be established for the processing of your information.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Under normal circumstances your information will only be used in relation to your care and treatment and is not shared unless you give your permission (consent).  For example, if we would like to use your personal information to help with research or publicity, we will always ask you to agree to this. You have the right to refuse this sort of request – and if you give permission and then change your mind, you can withdraw your consent at any time.

The practice has aligned with the National Data Opt-out and further information can be found at

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes

 Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

  • Your request should be made to the Practice – for information from the hospital you should write direct to them
  • There is no charge to have a copy of the information held about you
  • We are required to respond to you within one month
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

Objections / Complaints

Should you have any concerns about how your information is managed at the GP, please contact the Practice or the Data Protection Officer as above. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:

Wycliffe house

Water Lane




Tel: 01625 545745

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Data Protection Officer.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the

Data Protection Officer:

Mr Michael Maginnis

Chesterfield Royal Hospital NHS Foundation Trust




S44 5BL

General Practice Transparency Notice for GPES Data for Pandemic Planning and Research (COVID-19)

This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital.

The health and social care system is facing significant pressures due to the coronavirus (COVID-19) outbreak. Health and care information is essential to deliver care to individuals, to support health, social care and other public services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the coronavirus outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. This practice is supporting vital coronavirus planning and research by sharing your data with NHS Digital, the national safe haven for health and social care data in England.

Our legal basis for sharing data with NHS Digital

NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020(COVID-19 Direction).

All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.

Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation. Our legal basis for sharing personal data relating to health, is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Direction.

The type of personal data we are sharing with NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

  • diagnoses and findings
  • medications and other prescribed items
  • investigations, tests and results
  • treatments and outcomes
  • vaccinations and immunisations

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

Data Processing Agreement Between Royal Primary Care and DocMail

Background Information

1.1    The service Data Processor is Derby and Derbyshire Integrated Care Board which provides a Medicines Management Service (including dieticians’ advice and Medicine Order Line) to GP Practices in the ICB. The service includes support and facilitation for functions connected with ensuring effective medicines management within the practice/s.

1.2    This Agreement provides an operating framework to enable lawful disclosure of Data to the Data Processor working on behalf of the Data Controller taking account of the Data Protection Legislation, the Common Law Duty of Confidentiality, and other applicable legislation.

1.3    Compliance with the Data Protection Act 1998 will automatically transition to any new UK Data Protection legislation without the requirement to issue a new Agreement.

1.4    The terms and conditions of this Agreement shall apply to all Data provided by the Data Controller, or provided to the Data Processor on behalf of the Data Controller, or obtained by the Data Processor from other sources as part of the delivery of the contracted services, or derived from any combination thereof.

1.5    This Agreement between the Data Controller and the Data Processor supports all Data processed by the Data Processor of behalf of the Data Controller in relation to Medicines Management. This includes storing; transforming; deriving; analysing and making reports available to the Data Controller, at either identifiable level (personal data) or aggregate level as required, along with the provision of aggregated level reports to Joined Up Care Derbyshire ICB on behalf of the Data Controller.  It will further support any additional data processing activities agreed with the Data Controller through a Service Level, or equivalent agreement.

  • Definitions and Interpretation

The following definitions shall apply in this agreement.

  • Aggregate Data – As per the Information Commissioner Office website, aggregate data is statistical data about several individuals that has been combined to show general trends or values without identifying individuals within the data.
  • Data Protection Legislation means (i) the DPA 1998 (ii) the GDPR, the LED and any applicable national Laws implementing them as amended from time to time (iii) the DPA 2018 (iv) all applicable Law concerning privacy, confidentiality or the processing of personal data including but not limited to the Human Rights Act 1998, the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations
  • Data – any information as defined in 2.1, 2.12, 2.13 and 2.14 that the Data Controller is responsible for exercising control of. This includes all information supplied to the Data Processor by the Data Controller, or provided to the Data Processor on behalf of the Data Controller and any additional information that the Data Processor obtains during the term of the contract and shall apply equally to original Data and all back-up and/or copies printed out.
  • Data Controller – Shall take the meaning as defined in the Data Protection Legislation
  • Data Processor – Shall take the meaning as defined in the Data Protection Legislation
  • Data Processing – Shall take the meaning as defined in the Data Protection Legislation
  • Data Protection Impact Assessment – is an assessment carried out by the Data Controller to identify the impact of any processing of personal data.
  • Data Protection Officer – Shall take the meaning given in the Data Protection Legislation.
  • GDPR – General Data Protection Regulation 2016
  • Information Commissioner’s Office – Upholds information rights in the public interest, promoting openness by public bodies and data privacy for individuals.
  • LED – Law Enforcement Directive (Directive (EU) 2016/680)
  • Other Confidential Information – any information or combination of information that contains    details about an organisation or an individual person that was provided in an expectation of confidence. This includes for example, non-personal corporate or technical information that is commercially sensitive, drafts of documents that are not ready for publication, restricted information and documents, etc. as well as personal data about patients, service users and staff.
  • Personal Data – Shall take the meaning as defined in the Data Protection Legislation.

2.14   Pseudonymised Data – Shall take the meaning as defined in the Data Protection Legislation.

2.15 Sub- Processor – means any third party appointed to process Personal Data on behalf of the Data Processor related to the agreement.

3.0    Description of Data/Reports

3.1    The Data covered in this Agreement is as detailed in section 3.2 and where relevant is indicated as aggregate data, other confidential information, personal data and pseudonymised level data (as defined in paragraphs 2.1, 2.12, 2.13 and 2.14 respectively). The Data Processor shall not disclose any Data to any third party without the prior written consent of the Data Controller, either through this Agreement or a separate written instruction from the Data Controller.

The Data Processor will undertake work in primary care to deliver improvements in safe, cost effective evidence based prescribing of medicines and medical devices on behalf of, and in agreement with practices.

  • Requirements
    • Type of personal data: Name, address, date of birth
    • Special categories of personal data; race, ethnic origin and health
    • Categories of data subject: staff, patients, patients carers, third party providers (e.g. community pharmacy, dieticians)
    • Patient’s Confidential Data (PCD) will be processed in support of the Data Processor’s Service to provide advice on medicines management and prescribing queries, and review prescribing medicines to ensure it is safe and cost-effective.

The Data Processor will process patients’ confidential data (PCD) as follows (this list is not exhaustive)

  • SystmOne or EMIS Web searches for patients with potential causes of medicines-related harm, followed by review of the records of patients whose prescriptions put them at risk of significant harm, to enable a suitable suggestion to reduce the clinical risk to be made to the Data Controller.
  • SystmOne or EMIS Web searches for patients who are prescribed a specific drug, followed by viewing these patients’ records to check they have no contra-indication or other obvious reason not to switch to a lower cost drug that is as effective or more effective.
  • When checking that a patient has no contra-indication to a lower cost drug finds another aspect of the prescription that merits investigation (e.g. a safety risk).
  • When performing training and induction of staff, trainee will view work outlined above to reduce medicines-related harm or avoid unnecessary expenditure, or during peer review of a MMT undertaking this work.
  • During the preparation and refinement of the work outlined above to reduce medicines-related harm or avoid unnecessary expenditure, to ensure the work is safe and effective.
  • SystmOne or EMIS Web searches for patients whose polypharmacy may be problematic (e.g. they are prescribed at least 10 medicines and have at least one potential cause of significant medicines-related harm). The MMT member reviews the notes of patients found by the search:
  • to establish if there is any obvious reason not to invite them to the practice for a medication review
  • who have already accepted an invitation to a medication review.
    • When a GP has asked their MMT member to review a specific patient’s record, usually when the GP has a question about the patient’s drug treatment.
    • When another member of the practice team (e.g. a practice nurse, practice manager or health care assistant) has requested advice from a MMT member on a prescription- or medicines-related aspect of the patient’s care.
    • When working as part of a multidisciplinary team in a health centre. Derbyshire ICS’ ‘hubs’ are an example.  Selected frail patients are invited to attend the ‘hub’ for extended appointments with GPs and other professionals.  The MMT member views the patient’s record, conducts a records-based medication review and discusses findings with the multidisciplinary team before the patient’s appointment.  A GP asks the MMT member to see some patients; the MMT member views the patient’s record in connection with that consultation.
    • In connection with provision of funding to hospitals for high cost medicines that are not included in national tariff prices:
  • Patients’ hospital and NHS numbers are provided on funding requests. These are used by MMT member and a database coordinator to check that the patient is registered at a general practice (so that the ICB is responsible for funding the medicine for the patient).
  • Patients’ hospital numbers are provided on the spreadsheet (SLAM) that MMT member and the database coordinator use to check that hospitals are only charging us for medicines following approval by the ICB of a funding request for the medicine for that patient.
    • When working in care homes. Patients’ medicines administration charts are reviewed and sometimes checked against the patient’s SystmOne record if errors are suspected.
    • Accessing patient records to obtain demographics in order to respond to medicines related queries.
    • When processing requests for Medicines as part of the ‘Medicines Order Line’ (applicable only where the specific ‘MOL SLA’ is in place between the Data Controller and the Data Processor)
    • Other examples may include FP10 prescription recall from NHSBSA- e.g. for CD monitoring, prescribing code issues or other issues.

3.3: Solely for the secure receipt, printing and postage of patient letters, DocMail has been engaged by the ICB with the agreement of member practices.

With your agreement, the ICB have engaged with DocMail to enable the secure transfer of letters to them for printing and postage directly to patients.  This has been subject to a Data Protection Impact Assessment, and DocMail added to this agreement as a data processor on your behalf.

This has been necessary to support a hybrid working model, where ICB employed staffs are not always working within a practice to enable the postage of paper letters.

4.0    Data Controller Responsibilities

4.1       The Data Controller is the Data Controller of the data insofar as it is personal data as defined by Data Protection Legislation and, shall at all times, ensure that personal data is only processed lawfully and in accordance with the Data Protection Legislation.

4.2       It is the legal duty of the Data Controller to comply with the Data Protection Legislation in relation to all personal data with respect to which he is a Data Controller (unless an exemption applies).

4.3       The Data Controller shall not instruct the Data Processor to process personal data on its behalf under this agreement where the Data Controller itself does not have a secure basis in law to process that data.

4.4       The Data Controller is legally responsible for the data processing carried out by the contracted Data Processor.

4.5       Under the terms of this agreement the Data Controller shall provide the Data processor with the minimum amount of Data necessary to deliver the contracted service. In the case where data is received by the Data Processor on behalf of the Data Controller from another source, only the minimum amount of Data will be processed to meet the objective.

4.6       The Data Controller will not contract services from Data Processors unable or unwilling to comply with the terms of this Agreement and reserves the right to terminate the contract if either party is unable to agree necessary amendments in future.

4.7       The Data Controller will supply the Data Processor with documentation as outlined in 13.2.1

5.0    Data Processor Responsibilities

5.1       NHS Derby & Derbyshire Integrated Care Board Medicines Management Team, is the Data Processor and shall at all times only process the personal data in its possession and held on behalf of the Data Controller lawfully and as instructed by the Data Controller and in accordance with Data Protection Legislation and this agreement. If the Data Processor is required to do otherwise by law the Processor will notify the Data Controller promptly before processing the Personal Data unless prohibited by Law.

5.2       The Data Processor undertakes to fully comply with all related and relevant legislation, regulatory and industry standards, including (but not limited to) Data Protection Legislation as defined in this agreement; the Human Rights Act 1998; the Common Law Duty of Confidentiality; the Computer Misuse Act 1998, the NHS Care Record Guarantee, the NHS Constitution, the NHS Code of Confidentiality; Caldicott Principles and guidance issued by the Information Commissioner as the Regulatory Body and NHS England.

5.3       The Data Processor will inform the Data Controller immediately if it is asked to undertake any processing that would infringe the Data Protection Legislation of the EU or any member state.

5.4       Where relevant, the Data Processor shall comply with the Data Controller’s obligations contained in any contract or agreement the Data Controller enters into with NHS Digital (HSCIC) such as a Data Sharing Framework Contract or any specific Data Sharing Agreement, or any other similar obligations of the Data Controller as notified to the data processor by the Data Controller.

5.5       The Data Processor shall not cause or allow Data to be transferred to any territory outside the European Economic Area without the prior written permission of the Data Controller.

5.6       Any unauthorised processing by the Data Processor of the Data Controller’s personal data beyond the terms and conditions set out in the agreement is unlawful and will be dealt with by the Data Controller as a personal data breach in accordance with NHS policy (See Section 7).

5.7       The Data Processor shall put in place appropriate technical and organisational measures against any lawful processing of Data and against accidental loss, destruction of and damage to Data; such measures will be commensurate with the category of data being processed (as per 2.1, 2.12, 2.13 and 2.14 ).

5.8       The Data Processor shall ensure that the data for which the Data Controller is responsible shall be held securely and separately from any other data that the Data Processor is required to hold under contract with other persons.

5.9       The Data Processor shall provide reasonable cooperation and assistance in relation to the provision of the necessary assurances and guarantees, to the Data Controller in their responsibility to ensure compliance with the technical and organisational security measures to protect the processing of personal data.

5.10     The Data Processor agrees to maintain good information governance standards and practices, and, as a minimum, will meet or exceed the Information Governance Toolkit requirements specified in section GC21 of the General Conditions of the NHS Contract, or to an equivalent standard in any subsequent NHS Information Governance compliance tool/process.

5.11     The Data Processor shall have confidentiality, information security, data protection and records management policies as required by the NHS Information Governance toolkit (or to any subsequent replacement Information Governance compliance tool/process)

5.12     The Data Processor shall have appropriate procedural/guidance documents which outline the processing undertaken by the data processor’s staff that will demonstrate compliance with this agreement.

5.13     The Data Processor shall provide the Data Controller with copies of policies referred to in 5.11 above.

5.14     The Data Processor agrees to attain the standards of information governance practice that the Data Controller is required to attain.

5.15     The Data Processor shall assist the Data Controller and provide any necessary information for the completion of Data Protection Impact Assessments. (DPIA)

5.16     The Data Processor shall provide reasonable assistance to the Data Controller where the outcome of a DPIA necessitates consultation with the Information Commissioner’s Office.

5.17     The Data Processor will designate a Data Protection Officer and will communicate to the Data Controller the name and contact details of any Data Protection Officer.

6.0    Confidential Personal Data

6.1       The Data Processor shall not store, copy, disclose or use the Data Controller’s data except as necessary for the performance by the Data Processor of its obligations under this Contract or as otherwise expressly authorised in writing by the Data Controller.

6.2       In particular, the Data Processor shall not share the personal data that the Data Controller is responsible for with any, individual, business or third party (in whole or in part) without the prior agreement and written permission of the Data Controller; nor process personal data in any way or for any purpose that has not been instructed and authorised by the Data Controller.

6.3       The Data Processor shall not subcontract any of its processing operations performed on behalf of the Data Controller under this Agreement (with the exception of IT services including data destruction of electronic or hard copy Data) without the prior written consent of the Data Controller. Where the Data Processor subcontracts its obligations, it shall do so only by way of a written agreement with the sub-processor which imposes the same obligations on the sub-processor as are imposed on the data processor under this Agreement. Where the sub-processor fails to fulfil its data protection obligations under such written agreement the data processor shall remain fully liable to the Data Controller for the performance of the sub-processor’s obligations under such agreement.

6.4       For the avoidance of doubt, a third party in the context of this agreement is any person other than the Data Controller and its staff or the Data Processor and its staff authorised to process data on behalf of the Data Controller.

6.5       The Data Processor shall not delete or remove or otherwise dispose of any personal data or information that the Data Controller is responsible for without the express authorisation of the Data Controller.

6.6       The Data Processor will keep a record of all processing of personal data it carries out on behalf of the Data Controller.

7.0    Data Security Requirement

The Data Processor shall:

7.1       Put in place appropriate technical and organisational measures to ensure the protection of the Data which is subject to this Agreement against the accidental loss or destruction of or damage to Data, having regard to the specific requirements set out in this Agreement, the state of technical development and the level of harm that may be suffered by the Data Controller and/or by a Data Subject whose Personal data is affected, by such unauthorised or unlawful processing or by its loss, damage or destruction.

7.2       Take reasonable steps to ensure the reliability of the Data Processors’ personnel who have access to the personal data, which shall include:

7.2.1       Ensuring that all staff engaged by the Data Processor, including agency and contract staff, required to access the Data Controller’s data understand the confidential nature of the personal data, and have received appropriate training to understand and comply with their responsibilities under Data Protection Legislation, the Common Law duty of Confidentiality and this agreement prior to their use of the data. The Data Processor will provide the Data Controller with evidence of that training on request.

7.2.2       The Data Processor shall include appropriate confidentiality clauses in employment contracts, including details of sanctions against employees acting in a deliberate or reckless manner that breaches confidentiality or the non-disclosure provisions of the Data Protection legislation or causes damage or loss of data

7.2.3       Have a documented disciplinary policy and procedure that clearly states the action that will be taken in the event of a Data breach.

7.2.4       Undertaking all reasonable background checks to ensure the reliability of all employees who are likely to use or have access to the Data.

7.2.5       The Data Processor shall ensure that all employees are aware of and act in accordance with policies and procedures referred to in 5.11 and 5.12.

7.3       In controlling access to the Data Controller’s Data ensure:-

7.3.1    That access to the personal data is on a strict ‘need to know basis’ and is limited to only those employees who need access to meet the Data Processor’s obligations as instructed under this agreement;

7.3.2    That it has properly configured and documented access rights for its staff, including a well-defined starters and leavers process to ensure appropriate access control;

7.3.3    That suitable and effective authentication processes are established and used to protect personal data;

7.3.4    That audit and monitoring systems are in place to monitor access to the Data Controller’s personal data and to ensure such access is appropriate and authorised and staff comply with organisational policy and the law;

7.3.5    That appropriate disciplinary action will be taken against any unauthorised access, unlawful disclosure or misuse of the personal data. Any personal data breach incident should be reported to the Data Controller in accordance with Section 11.

7.3.6    That any staff involved in delivery of the contracted service who do not specifically need to use personal information as part of their role have access restricted to anonymised data, pseudonymised data and/or redacted extracts only.

7.4       Employees must not access the Data Controller’s data remotely e.g. from home or via their own electronic device or internet portal other than through a secure electronic network, when authorised to do so and in accordance with organisational remote working policy.

7.5       Employees must not hold the Data Controller’s data on personal equipment and, where it is essential to hold data on approved NHS portable devices; it is authorised and held securely in accordance with NHS policy;

7.6       Where data is transferred it must be transferred securely, only where it is essential to do so in relation to this agreement and when data is transferred electronically it is encrypted to the higher of the international data encryption standards for healthcare and National Standards (this includes data transferred over wireless or wired networks, held on laptops, CDs, memory sticks and tapes).

7.7       Where instructed by the Data Controller to dispose data, it is disposed of securely and confidentially in accordance with Section 13.

8.0    Security – IT Systems

8.1    The Data Processor shall hold electronically-based Data on secure servers in accordance with NHS information security standards.

8.2    Data will, under no circumstances, be stored on unencrypted portable media or devices such as laptops or USB memory sticks or CD-ROM.

8.3    The Data Processor shall ensure that all portable media used for storage or transit of Data is fully encrypted in accordance with current NHS Guidelines on encryption.

8.4    The Data Processor shall not allow employees to process Data on their own personal computers.

8.5    The Data Processor shall ensure adequate back-up facilities to minimise the risk of loss of or damage to Data and that a robust business continuity plan is in place in the event of restriction of service for any reason.

8.6    The Data Processor shall not transmit Data by email except as an attachment encrypted to 256 bit AES\Blowfish standards or from NHS mail to NHS mail.

8.7    The Data Processor shall ensure that any other method of data transmission is in accordance with the NHS Information Security Assurance Detailed Guidance on Secure Transfers of information available from the NHS Digital (HSCIC) website, for example, secure file transfer protocol.

8.8    The Data Processor shall ensure that any data management environment hosted by the Data Processor will be secure and in compliance with NHS information security standards; that only authorised staff of Data Processor will be granted access to Data and that such access will be to the minimum amount of data necessary.  The Data Processor shall undertake only to grant access to any other users who are not staff of the data processor, upon the authorisation of the Data Controller.

8.9    The Data Processor shall only make printed paper copies of Data if this is essential for delivery of the contracted service.

9.0    Security – Physical

9.1       The Data Processor shall ensure that all Data is physically protected from accidental or deliberate loss or destruction arising from environmental hazards such as fire or flood.

9.2       The Data Processor shall ensure that all Data is held on premises that are adequately protected from unauthorised entry and/or theft of Data or any IT equipment on which it is held by, for example, the use of burglar alarms, security doors, ram-proof pillars, controlled access systems, etc.

10.0  Business Continuity & Disaster Recovery

10.1     The Data Processor shall ensure it has documented Business Continuity and Disaster Recovery Plans (BCDRP) in place which are reviewed, kept up to date and tested for of all of the Data Controller’s critical information assets. The BCDRP shall detail the processes and arrangements which the Data Processor will follow to ensure continuity of the business processes and operations supported by the Data Processor following any failure or disruption or element of the services and recovery of those services in the event of a disaster.

10.2     The BCDRP will set out the various possible levels of failures of or disruptions to the service and the services to be provided and the steps to be taken to remedy the different levels of failure and disruption and the conditions or circumstances under which the Disaster Recovery Plan is invoked.

11.0  Incident Reporting & Duty of Candour

11.1     The Data Processor shall have procedures in place to monitor access and to identify unauthorised and unlawful access and use of personal data.

11.2     The Data Processor shall immediately notify the Data Controller of any untoward incidents or activities that suggest non-compliance with any of the terms of the Agreement. This includes any suspected breach of confidentiality or any other information governance or cyber security incident. This includes ‘near miss’ situations even if no actual damage to or loss or inappropriate disclosure of Data results.

11.3     The Data Processor will co-operate fully with the Data Controller into the investigation of any activity outlined in 11.2 above.  Any such investigation must be consistent with the current national requirements for incident reporting.  At the time of writing this Agreement the current requirements are contained in the HSCIC (NHS Digital) document “Checklist Guidance for Reporting, Managing and Investigating Information Governance and Cyber Serious Incidents Requiring Investigation”.

11.4    In so far as the Data Controller is responsible for the personal data, it is the Data Controller’s responsibility to ensure that the incident is reported in accordance with the Department of Health policy and procedures are in place for informing data subjects as appropriate.

11.5     The Data Processor will provide assistance as requested by the Data Controller in relation to informing Data Subjects about any incidents, including communication with the Data Subject

12.0  Requests for Information & Complaints

12.1     The Data Processor shall notify the Data Controller immediately if it receives:

12.1.1  A request from a Data Subject to have access to that person’s personal data; or

12.1.2  A request to rectify, block or erase any personal data; or

12.1.3  A request for information under the Freedom of Information Act 2000 (FOIA); or

12.1.4  Any communication from the Information Commissioner connected with the personal data processed under this agreement; or

12.1.5  A complaint or request relating to the Data Processor and/or the Data Controller’s obligations under Data Protection Legislation, in relation to the Data being processed by the Data Processor.

12.2     The Data Processor will provide full cooperation and assistance to the Data Controller in relation to any request or complaint or request, and will:

12.2.1     Provide the Data Controller with full details of the request or complaint;

12.2.2     Comply with the data access request with the relevant timescales set out in the legislation

12.2.3     Only act upon the specific instructions of the Data Controller in relation to any such request.

13.0  Data Retention & Secure Destruction

13.1  All Data (see 3.2) above remains the property of the Data Controller and shall be either returned or destroyed by the Data Processor after an agreed period after completion of the contracted service, in a manner agreed with the Data Controller.

13.2  NHS data is subject to legal retention periods and should not be destroyed unless the Data Processor has received specific instruction to do so from the Data Controller. Where data has been identified for disposal:

13.2.1  The Data Processor shall retain personal data/reports in line with the Data Controller’s records retention schedule.

13.2.2  Aggregate level data/reports shall be retained for a period of 6 years enable trend analysis reporting.

13.2.3 The Data Processor shall ensure that NHS information held in paper form  (regardless of whether originally provided by the Data Controller or printed from the Data Processor’s IT systems) is destroyed using a cross cut shredder or  subcontracted to a confidential waste company that complies with European Standard EN15713.

13.2.4 The Data Processor shall ensure that electronic storage media used to hold or process NHS Information is destroyed or overwritten to current CESG standards as defined at

13.2.5 In the event of any bad or unusable sectors that cannot be overwritten, the Data Processor shall ensure complete and irretrievable destruction of the media itself.

13.2.6 The Data Processor shall provide the Data Controller with copies of all relevant overwriting verification reports and/or certificates of secure destruction of NHS information at the conclusion of the contract.

13.2.7 Where the Data Processor engages the services of a 3rd Party data Destruction Company (for electronic or hard copy Data) the Data Processor will ensure that the standards required in 13.2.1 are complied with and that prior written consent is obtained from the Data Controller.

14.0 Monitoring & Audit

14.1  The Data Processor shall permit the Data Controller to monitor compliance with the terms of this Agreement, by:

14.1.1  Allowing Data Controller employees or nominated representatives to enter any premises where Data is held, at all reasonable times and with or without prior notice, for the purpose of inspection.

14.1.2  Completing and returning a Data Processing Monitoring Form at the request of the Data Controller.

14.1.3  Undertaking an annual independent audit of its Information Governance Toolkit audit to provide assurance that the self-assessment is accurate and a true indication of performance against the prescribed standards and, shall provide the Data Controller with a copy of the report if requested to provide assurance that the contracted requirement is fully met.

15.0 Legal Jurisdiction

15.1  This Agreement is governed by and shall be interpreted in accordance with the law of England and Wales.

15.2  In the event of a dispute, the parties to this Agreement agree to attempt to resolve such issues according to NHS dispute resolution procedures. In the event that agreement cannot be reached, the parties agree that the courts of England and Wales shall have exclusive jurisdiction to hear the case.

16.0 Agreement Duration & Effect

16.1  The Data Controller may terminate this Agreement with immediate effect by written notice to the Data Processor on or at any time after the occurrence of an event that gives rise to an information security incident or otherwise poses a risk of non-compliance with the data protection principles or this Agreement.

16.2  This Agreement will remain in force for as long as the Data Processor is commissioned to provide the Service requiring data processing as per 3.2, unless it is superseded by a newer version.  A newer version may be initiated for a variety of reasons e.g. change in terms and conditions/role and responsibilities mutually agreed between both Parties.

16.3 Any minor changes to this Agreement that may become necessary from time to time shall be made by the Data Controller to the Data Processor, or requested by the Data Processor from the Data Controller, as a written variation.

16.4 In the event of major changes being required, the Data Controller shall terminate this Agreement and replace in full with an updated version. Such termination and replacement may also be initiated by the Data Processor, subject to prior arrangement with the Data Controller.

16.5 The terms of the contract will be reviewed after 3 years.

17.0  Extent of Liability

17.1     Nothing within the agreement relieves the Data Processor of its own direct responsibilities and liabilities under Data Protection legislation.

17.2     Neither Party shall be liable to the other Party for any loss or damage, costs or expenses incurred or suffered by the other Party as a result of any breach of the terms of the Agreement, unless the same were in the reasonable contemplation of the Parties at the time when they entered into the Agreement.


Date published: 20th September, 2023
Date last updated: 10th January, 2024