Skip to main content

Systemic Anti-Cancer Therapy (SACT): GDPR information


Why and how we process your data in the Systemic Anti-Cancer Therapy (SACT) data set and your rights.

Controller NHS Digital, NHS England and Public Health England
How we use the information (processing activities)

The data is analysed, potentially in combination with other health and/or population datasets to understand the impact of COVID-19, its risks to patients and health services and to monitor and manage the response to COVID-19 by health and social care bodies and the Government. The data will be used for these purposes by NHS Digital and external organisations subject to authorisation via NHS Digital’s Data Access Request Service (DARS).

Does this contain sensitive (special category) data such as health information? Yes
Who are recipients of this data?

External users as permitted through Data Sharing Agreements (DSA) via the Data Access Request Service (DARS)  - see the data release register for more details.

Is data transferred outside the UK? This data is not transferred out of the UK
How long the data is kept The data will be kept for as long as NHS Digital is directed to operate the COVID-19 Public Health NHS England Information Systems and undertake the system delivery functions. The expected end date is currently 31st March 2021, unless revoked earlier or replaced by a further direction.
Our lawful basis for holding this data Legal obligation
Your rights
  • Tick Be informed
  • Tick Get access to it
  • Tick Rectify or change it
  • Cross Erase or remove it
  • Tick Restrict or stop processing it
  • Cross Move, copy or transfer it
  • Cross Object to it being processed or used
  • Cross Know if a decision was made by a computer rather than a person
How can you withdraw your consent?

Consent is not the basis for processing.

Where does this data come from? SACT data is collected from NHS Trusts in England by Public Health England and supplied to NHS Digital. For further details, see:
The legal basis for collecting this data

Article 6 - Legal Obligation (Requested to establish information system),
Article 9 - Substantial Public Interest.
DPA 2018:
Schedule 1, Paragraph 6 - Statutory etc and government purposes