NHS England and NHS Improvement: how we use your information

Find out more about how we use your information in the following areas:

Designing and implementing the new NHS England and NHS Improvement joint operating model


The Joint Working Programme launched the new Operating Model on 1 April 2019.  This was the start of the new National Director and Executive Senior Management structure as published and consulted on at the end of 2018.

Part of the preparation work has been to ensure that all staff are aligned to this new senior management structure for 1 April 2019.  For many this will not involve a change, but for some this will involve a change of line manager.  This will be the only change, and there will be no change in terms and conditions or ways of working.

The Joint Working Programme team are also working on the detailed design of the operating model for all staff at band 9 and below. The Joint Working Programme team is working in partnership with the Unions and any proposed changes to staff terms and conditions which arise from the new design work will be subject to consultation.

Categories of personal data and sources

In order to be able to ensure staff are aligned to the correct senior manager the Joint Working Programme team have used staff records from the Electronic Staff Records and from discussions with individual managers in both organisations. They are also using similar information for the design of the operating model.

The personal data necessary for the alignment and design work includes name, job title, job description, email address, work phone numbers, job grade and pay (salary and allowances), fixed term end date, employment status (permanent, temp, secondment etc), role (part-time, full-time, flexible working arrangements), position in the organisational structure, substantive position, working hours / full time equivalent, primary work location, employee number, assignment status (e.g. career break / maternity leave). From these data items the minimum necessary is used in relation to each member of staff.

Categories of recipients

For individual staff members the data is used by design and delivery leads working in each directorate (2 or 3 per directorate) and shared with relevant managers in both organisations. Information that identifies staff directly is needed because design and alignment requires managers’ knowledge as well as data held on ESR.

As some new directorates are made of a composite of different directorates across both organisations and some of the new functions will be delivered by a combination of NHS England and NHS Improvement staff there is a need for appropriate sharing of information between individuals in both organisations.

Legal basis for processing

For the GDPR purposes NHS England’s and NHS Improvement’s lawful basis for processing is Article 6(1)(e) ‘…exercise of official authority…’. This is underpinned by our statutory duties to cooperate.

Our workforce – HR and Organisation Development

How NHS England and NHS Improvement use personal data jointly for employment purposes

Our joint employment purposes

NHS England and NHS Improvement are working together to establish integrated Human Resources services, and the components of this joint service will be designed and implemented during 2019/2020. The purposes related to employment for which we currently process personal data jointly are:

Staff recruitment

NHS England and NHS Improvement have established a joint recruitment service, and are responsible as joint controllers for the processing of personal data that you provide on your application, and from other sources. We have engaged the NHS Business Services Authority (NHSBSA) to process applications for employment on our behalf.

NHS BSA works with NHS England and NHS Improvement through each stage of the recruitment process using our end-to-end recruitment system TRAC, this includes pre- and post-interview activities up to confirming the offer of employment and issuing a contract.  If you applied for a vacancy using NHS Jobs your application will be imported into the TRAC recruitment system and all information you receive about your application will be generated by TRAC.  You may be invited to create a TRAC account if you are shortlisted to enable your application to be managed through the system.

We will use information you have provided to verify your identity when we speak to you, and at all stages of the application process.

For successful applicants

Before agreeing a contract, we will use the information you have provided to complete the following pre-employment checks in line with NHS Employers’ guidance:

  • Professional registration checks
  • Employment history and reference checks
  • Disclosure and Barring Service (DBS) check (if required)
  • Work health assessment: to check you are fit to work or confirm what reasonable adjustments are required, if applicable
  • Confirming Right to Work, identity, and eligibility for the vacancy
  • Meeting safeguarding law requirements where this is relevant to the vacancy role

NHS England and NHS Improvement are also required to monitor the diversity of candidates to ensure we comply with the Equality Act 2010.

Categories of recipients

We share your information with:

  • medical professionals, to assess your fitness to work and any reasonable adjustments that you need
  • the Disclosure and Barring Service (DBS), if your role requires a DBS check
  • with named referees to obtain a reference
  • any other organisation who has a legal right to it.

Your information will not be transferred outside the European Economic Area (EEA),

Keeping your personal information

For non- successful applications, personal information in the e-recruitment system will be deleted within 400 days of the advertised application closing date. This information is retained so that we can revisit vacancies and applications in case the vacancy needs re-advertising or to enable us to respond to any candidate queries.

Successful applications will remain in the system for 400 days, but only information relevant to the employment of successful candidates will be retained within staff employment records.  This will be specified in your contract of employment. If you withdraw at offer stage, you will not receive any further information and your details may still be retained for 400 days securely outside of the e-recruitment system

Equal opportunities monitoring

We have established a joint analytics team that is responsible for analysing data to enable reporting on compliance with equal opportunities requirements by NHS England and NHS Improvement. This supports workstreams such as the Workforce Race Equality Standard, the public sector Equality Duty and the Gender Pay Gap, which are mandatory for NHS employers.

Record level staff data is required to enable analysis by data items representing any characteristics relevant to equalities monitoring. Personal data including employee number is obtained from the Electronic Staff Record and other sources for example appointments to roles.

The dataset extracted includes employee number, data about role including grade and pay scale, position, type of contract, working hours, also protected characteristics including gender, ethnic origin, disability, marital status, sexual orientation, age band, religious belief.

The employee number is required to enable linkage between datasets.

Access to personal data including employee number is restricted to members of the joint analytics team.

Line management

With the introduction of joint working, most teams will include a combination of staff that have employment contracts with either NHS England or NHS Improvement. Line managers may be employed by either organisation. Where this is the case the manager is responsible for ensuring that the duties of both organisations as employers are discharged appropriately in relation to the staff that he or she manage.

Managers have access to the Electronic Staff Records of their staff, and use this to keep employment details up-to-date and manage the development of their staff, training compliance, annual leave and other absence. Managers use personal data relating to the health of their staff for the following purposes:

  • Reimbursement of expenses
  • Maintenance of professional registration
  • Sickness absence management
  • Maternity and adoption
  • Occupational Health and accommodating special workplace needs.

Sickness absence management

As employers, NHS England and NHS Improvement have legal duties to ensure the health and safety of their employees at work, and that their employees receive their sickness pay allowance entitlement. We must also ensure that we comply with employment rights legislation around sickness absence.

Managers need to know that that their staff are fit for work, and be aware of adjustments that may be to necessary to support staff following a period of sickness. For these purposes they will receive GP fit notes from the staff that they manage. These indicate whether or not an individual is fit for work, and may give advice on any support required to accommodate an illness or condition when returning to work.

Managers will also receive return to work forms completed by their staff, and conduct return to work interviews to agree on any adjustments required.

Managers must ensure that the Electronic Staff Record (ESR) for their staff is kept up to date with sickness absence records. This enables us to comply with employment rights legislation when managing sickness absence.

By analysing the data extracted from the ESR we are able to identify and address any inequalities, and target health and wellbeing interventions.

Maternity, paternity and adoption

Managers are responsible for ensuring that the rights of their staff are respected when they are to become mothers or fathers.

They will receive completed MATB1 and matching certificates, which confirm details around a pregnancy or adoption. These forms are shared with HR and payroll ensuring communication with the employee about their entitlements and correct payment during periods of leave and

Occupational Health and accommodating special workplace needs

Line managers may refer a member of staff, with their consent, for an occupational health assessment.

The NHS England / NHS Improvement Occupational Health Providers are external providers. Managers will share your contact details and referral with the providers as required.

Managers will receive occupational health reports to inform them of any adjustments that are required.

Legal basis for processing for our joint employment purposes

NHS England’s and NHS Improvement’s lawful basis for processing personal data jointly is Article 6(1)(e) ‘…exercise of official authority…’. This is underpinned by our statutory duties to cooperate, and accompanies other the bases that apply, as described below.

For entering into and managing contracts with the individuals concerned, for example our employees the legal basis is Article 6(1)(b) – ‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

Where we have a specific legal obligation that requires the processing of personal data, for example equal opportunities monitoring, the legal basis is Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject’.

For other processing of personal data about our employees, our legal basis is Article 6(1)(e) – ‘…exercise of official authority…’.

Where we process special categories data for employment purposes the condition is: Article 9(2)(b) – ‘…processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’.

For the processing of information about the health of our workforce, the legal basis is: Article 9(2)(h) – ‘…processing is necessary for the purposes of preventive or occupational medicine…assessment of the working capacity of the employee…the provision of health or social care…’.