Skip to main content

NHS Business Services Authority (NHSBSA) Medicines Data: GDPR information

Summary

Controller NHS Digital (in relation to processing the personal data) and the Department of Health and Social Care (DHSC) (in relation to determining the purpose for processing the data through the issuing of a direction to NHS Digital)
How we use the information (processing activities) NHS Digital collects, publishes and distributes medicines data received from the NHS Business Services Authority (NHSBSA) each month to improve patient safety, help plan and improve NHS services and for research via NHS Digital's Data Access Request Service (DARS).
Does this contain sensitive (special category) data such as health information? Yes
Who are recipients of this data?

Data recipients are recorded in the Register of approved Data Releases. Information is also shared with NHS Business Services Authority to support medicines safety.

Is data transferred outside the UK? This data is not transferred out of the UK
How long the data is kept Data retention will be reviewed after 8 years (on 1 April for any data received in the previous 12 months)
Our lawful basis for holding this data Legal obligation
Your rights
  • Tick Be informed
  • Tick Get access to it
  • Tick Rectify or change it
  • Cross Erase or remove it
  • Tick Restrict or stop processing it
  • Cross Move, copy or transfer it
  • Cross Object to it being processed or used
  • Cross Know if a decision was made by a computer rather than a person
How can you withdraw your consent?

Consent not the basis for processing.

Is the data subject to decisions made solely by computers? (automated decision making) No
Where does this data come from? NHS Business Services Authority (NHSBSA)
The legal basis for collecting this data

GDPR:

Article 6 (1) (c) - Legal Obligation (Direction),
Article 9 (2) (g) - Substantial Public Interest - Statutory or Government Purposes (Direction),
Article 9 (2) (h)  - Management of health or social care systems and services.

DPA 2018:

Schedule 1, Part 1 - Health or social care purpose