Purposes for processing

The NHS Graduate Management Training Scheme (GMTS) provides fast-track leadership development for trainees across six different specialisms.

Trainees are employed on a fixed-term contract throughout their time on GMTS; they are employed by NHS Business Services Authority (BSA) on behalf of NHS England, and NHS England manage the scheme.  All employment processes for trainees are managed by NHS BSA, in conjunction with NHS England, including: contracts, payroll, policies and procedures.

Each Trainee is placed with one or more NHS organisations (or organisations providing NHS-funded services) during their time on the Scheme.

Trainees undertake post-graduate qualifications with one of a number of education providers depending on their specialism.

The duration of the scheme is two years to two and a half years. Data will be retained in line with NHS England’s Records Retention Policy.

Sources of the data

Data is provided by users on application and employment to the Scheme. Additional information is collected from individuals on initial logon to our trainee management system and ongoing administration of management and progression through the Scheme.

Categories of personal data

The NHS Graduate Management Training Scheme and associated contractors outlined below process different categories of personal information. NHS England process personal demographics, education and training data and medical information in order to administer the GMTS.

Categories of recipients

Additional recipients of data are:

• NHS Business Services Authority – process personal data for the purpose of employment of the trainee.
• GMTS recruitment team and contractors supporting recruitment process (Amberjack) – For the purpose of recruitment
• Education providers responsible for the ongoing academic elements of GMTS

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…exercise of official authority…’. For the processing of special categories data the basis is Article 9(2)(h) – ‘…health or social care…’.

NHS England as a Data Controller

NHS England is the data controller for the personal data processed for the management of the GMTS.

NHS BSA is the data controller for personal data processed for the employment of those placed on the GMTS.

For information in regard to NHS England’s Data Protection Officer, how to enact a subject’s rights request and for lodging a complaint with the Information Commissioner about any aspect of the processing of the personal data please visit: NHS England » NHS England as a data controller