Skip to main content

Medicines Spend and Use Data: GDPR information


Why and how we process your data in the Medicines Spend and Use Dataset and your rights.

Controller NHS Digital, Secretary of State for Health and Social Care
How we use the information (processing activities)

National health and care organisations require access to good quality, national data, about NHS medicine spend and use, to improve patient care and outcomes, understand the medicines market and manage medicines spend. NHS Digital is collecting and analysing data from participating NHS providers in order to carry out discovery work towards an eventual common specification or standard, for data collection. Clinician names and / or clinician codes will be collected, purely as a result of local practice where they have been recorded by providers as a means of identifying cost centres. No patient identifiable data will be collected.

Does this contain sensitive (special category) data such as health information? No
Who are recipients of this data?


Is data transferred outside the UK? This data is not transferred out of the UK
How long the data is kept 12 months minimum from when the data was collected
Our lawful basis for holding this data Legal obligation
Your rights
  • Tick Be informed
  • Tick Get access to it
  • Tick Rectify or change it
  • Cross Erase or remove it
  • Tick Restrict or stop processing it
  • Cross Move, copy or transfer it
  • Cross Object to it being processed or used
  • Cross Know if a decision was made by a computer rather than a person
How can you withdraw your consent?

Consent is not the basis for processing.

Is the data subject to decisions made solely by computers? (automated decision making) No
Where does this data come from? NHS providers commonly referred to as secondary care, and may include organisations commissioned by the NHS to provide NHS services e.g. medicines supply and medicines stock control services.
The legal basis for collecting this data

Article 6 - Legal Obligation (Discovery Direction),
Article 9 - Management of health or social care systems and services.
DPA 2018:
Schedule 1, Part 1 - Health or social care purpose.