NHS England (or the NHS Commissioning Board, which is our legal name) uses personal and confidential information for a number of purposes. This Privacy Notice provides a summary of how we use your information. To ensure that we process your personal data fairly and lawfully we are required to inform you:

• Why we need your data
• How it will be used and
• Who it will be shared with

This information also explains what rights you have to control how we use your information.

The law determines how organisations can use personal information. The key laws are: the Data Protection Act 1998 (DPA), the Human Rights Act 1998 (HRA), relevant health service legislation, and the common law duty of confidentiality.

Within these pages we describe instances where NHS England is the “Data Controller”, for the purposes of the Data Protection Act 1998, and where we direct or commission the processing of patient data to help deliver better healthcare, or to assist the management of healthcare services.

NHS England recognises the importance of protecting personal and confidential information in all that we do, all we direct or commission, and takes care to meet its legal duties.