NDRS transparency notice

The National Disease Registration Service (NDRS) is part of NHS England, who is the controller for the data held by the NDRS.

The NDRS collects information to count how many people in England have cancer, a rare disease or congenital anomaly. The data also shows which treatments are working well and this means the NHS can use the data to improve patient care across the country.

The NDRS is made up of two disease registration services called the:

• National Cancer Registration and Analysis Service (NCRAS) and the,
• National Congenital Anomaly and Rare Disease Registration Service (NCARDRS)

National Cancer Registration and Analysis Service (NCRAS)

The NCRAS will collect data about you, or your child, if you or your child:

• have been diagnosed or treated for cancer in England
• are suspected of having cancer
• have a high genetic risk of cancer
• have a condition which may lead to cancer

NCRAS collects data from NHS trusts in England whenever you or your child are seen by a clinical team.

Find more information about the NCRAS.  

National Congenital Anomaly and Rare Disease Registration Service (NCARDRS)

NCARDRS will collect data about you or your child from NHS clinical teams in England if you or your child:

• have been diagnosed with, or are at risk of a having a congenital anomaly - a congenital anomaly may be detected in pregnancy, or at birth, or may only become obvious as a baby grows older
• have a rare disease, or are at risk of having a rare disease
• you have a family member with a rare disease

Find more information about the NCARDRS.

The NDRS collects, analyses, publishes and shares data on cancer, rare diseases and congenital anomalies to help the NHS, researchers and others, including industry partners and charities to:

1. Understand these diseases - Data helps us understand how many people have cancer, congenital anomalies and rare diseases and who is most at risk of developing these diseases
2. Improve diagnosis - We use data to explore how and where people are diagnosed. We also use data to monitor and improve NHS screening programmes.
3. Plan NHS services - We use data to discover how many people have different types of cancer and rare diseases. We use this information to improve how patients are treated after diagnosis and help to measure the impact of screening programmes, or links between one disease and another such as the links between cancer and cardiovascular diseases
4. Improve treatment - We collect data to understand how different treatments affect patient outcomes and how treatments vary between hospitals.
5. Evaluate policy - Data helps us to compare survival rates and outcomes with other countries and monitor efforts to increase early diagnosis and the effectiveness of different treatments.
6. Improve genetic counselling - We use data to discover new gene mutations that cause cancer and rare diseases.  This information is used by the NHS to provide accurate genetic counselling and give extra care to those at risk
7. Carry out research - We partner with charities, academics and the NHS to carry out research in cancer, rare diseases and congenital anomalies. This helps us learn more about these diseases and informs clinical practice and treatments. We also share information with other organisations so they can carry out research. Any data we share is subject to robust rules relating to privacy, security and confidentiality.  

We explain more about this below, under 'Who we share data with'.

We start collecting data as soon as you, or your child, are being investigated for a possible cancer, a rare disease or a congenital anomaly. We then follow your treatment for the rest of your life. We do this because we need to see if the disease comes back and understand the effects of treatment you receive, some of which may only become apparent years later.

It is important we hold data for at least the lifetime of a patient so that we spot long term trends in the number of people diagnosed with these diseases, how well we are treating them, and to carry out research to improve prevention, diagnosis and care. In addition, some forms of cancer and rare diseases can be inherited. For those families with this genetic risk, long term monitoring is important.

National Cancer Registration and Analysis Service (NCRAS)

If you or your child have been diagnosed with cancer, or are suspected of having cancer or are at risk of developing cancer, the NCRAS collects the following data from NHS clinical teams to create a cancer registration record:

• name, address and postcode
• gender and ethnic background
• date of birth / age
• NHS number / hospital number / specimen number
• BMI, height and weight and any smoking and alcohol habits
• sexual orientation
• genetic data, including your genomic test results

We also collect information about your cancer diagnosis, your treatment and how well it is working. We collect this data from across the NHS, including from:

• pathology and testing laboratories
• cancer services and oncology systems
• hospital patient administration systems
• imaging reports, for example the written results of x-rays

You can find out more information about genomic testing and how your data is protected on the NHS website. 

We also collect data from UK Transplant Registry data from NHS Blood and Transplant this is with a view to better understanding the increased risk of skin cancer among people who have had organ transplants.

Some of the data held in or linked to cancer registration records is already held by NHS England, including:

• primary care prescriptions data
• mortality data
• hospital attendance data
• National Institute of Cardiovascular Outcomes Research (NICOR) data

Learn more about what data NCRAS collects and from which organisations.

National Congenital Anomaly and Rare Disease Registration Service (NCARDRS)

If you, your unborn baby or child have a suspected or confirmed rare disease or congenital anomaly, the NCARDRS collects the following data from NHS clinical teams to create a registration record:

• name, address and postcode
• gender and ethnic background
• date of birth / age
• NHS number / hospital number
• height / weight and BMI
• physical health and genetic data, including genomic test results

If necessary, data is also collected about family members. We collect this data from across the NHS, including from:

• screening and testing laboratories
• maternity care services
• neo natal paediatric care
• tertiary care services
• child health records
• routine radiology records

You can find out more information about genomic testing and how your data is protected on the NHS website. 

Some of the data held in NCARDRS registration records is already held by NHS England, including:

• hospital attendance data
• births data
• primary care prescriptions data
• mortality data

We also collect data from:

• rare disease research studies (where patients have given their consent to the data sharing)
• patient self-reporting (either directly or through patient registers, where consent allows)
• the British Pregnancy Advice Service (BPAS) - data on terminations of pregnancy due to a fetal anomaly only
• the UK Health Security Agency to help respond to health emergencies such as Zika virus or COVID-19, such as vaccine and testing data (including but not limited to the SARS-COV2 subset of SGSS)

Learn more about what data NCARDRS collects and from which organisations.

Quality checking

Our skilled registration officers check and quality assure the data we collect to make sure it is correct and complete. This might include contacting the hospital, laboratory or screening service to sort out any issues with the data they have sent to us.

Analysis and linkage

We analyse and link the data we collect to other patient data NHS England already holds, such as:

• hospital attendance data
• births data
• primary care prescriptions data
• mortality data

As an example, by linking data held by the NCRAS to that collected by the National Cancer Diagnosis Audit (managed by Cancer Research UK), we can audit the referral of cancer patients for investigation and help improve early diagnosis. By linking to data from the National Institute for Cardiovascular Outcome Research (NICOR), researchers can study the links between cancer and cardiovascular diseases.

We also link rare disease and congenital anomaly data to:

• 'Newborn Hearing Screening' data, to understand more about congenital hypothyroidism (CHT) and the effectiveness of the NHS newborn screening programme
• 'High Cost Medicines' data, to identify patients who have received specific high cost medicines and see how well these have worked 

Publishing statistics

We will use the data to publish national statistics and data outputs that contain only anonymous data which cannot be used to identify individuals. We never publish any data that could identify you.

We treat the data we hold with great care. All data which is shared by NHS England is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will ever be shared.

Wherever possible, de-personalised data or anonymous data is used and shared to protect patient confidentiality. We also apply the National Data Guardian’s Caldicott Principles to ensure we only provide the minimum amount of data necessary for the purpose for which it is to be used. In some cases, only personally identifiable data can be shared to achieve the purpose, but this is always done in accordance with the law and subject to safeguards to ensure that the data is kept safe and secure.

All requests by others to have access to data held by the NDRS are currently assessed on a case-by-case basis by the Data Access Request Service (DARS).  

DARS makes sure that organisations requesting access to the NDRS data:

• will only use it for a health and social care purpose, and for cancer data, they will only use it for a medical purpose as defined by Regulation 2 of the Health Service (Control of Patient Information) Regulations 2002 (COPI)
• cannot achieve their aim unless they can use data which could identify you (directly or indirectly)
• can only access the minimum amount of data needed to achieve the purpose
• access de-identified data after appropriate techniques have been applied to remove and prevent the disclosure of identifying information
• have an appropriate legal basis to request the data and have obtained all necessary legal and ethical approvals
• have appropriate safeguards in place to ensure that the data will be processed safely and securely

Data which would enable you to be directly or indirectly identified is only shared with:

• clinicians and the healthcare team providing you with care, such as your hospital or GP
• organisations who can provide evidence you have given them your explicit consent to the sharing of your data with them
• organisations who have been granted specific legal approval from the Health Research Authority’s Confidentiality Advisory Group to use confidential patient information without your consent and who also have ethical approval to do so, or
• organisations with whom we have a legal obligation to share confidential patient information without consent - for example where there is a Court Order, or where this is necessary for public health purposes under Regulation 3 of COPI.

There are a number of organisations the NDRS shares data with. These include: 

• your clinician/healthcare team: to provide you with care and treatment
• The National Institute for Health and Care Excellence (NICE): we work with NICE to provide an evaluation of the drugs which have been added to the Cancer Drugs Fund which supports a final report published by NICE
• The Office for National Statistics (ONS): to produce national statistics about cancer and rare diseases
• Integrated Care Boards (ICBs): to help plan and improve NHS healthcare services
• European Surveillance of Congenital Anomalies (EUROCAT): to bring together data on congenital anomalies collected by other population based registries in Europe so that expertise can be shared
• research organisations, including universities, charities, industry partners and clinical research organisations that run clinical trials: to carry out research 

Details about the data we have shared from the NDRS with other organisations will be published on the Data Release Register. 

This includes details of each organisation data has been released to, alongside the type of data released, the legal basis for release and the purpose for which the data was provided.

For releases made before the 1 October 2021, these releases are published in the ODR Data Release Register. 

National Disease Registration Service Opt-out

If you do not want your data to be used by the NDRS, you can opt out and your data will be deleted from the relevant register. You can also opt-out for your child if they are under the age of 13 or, if they are over 13 and you can show they lack competency to decide for themselves. Find out more information about the NDRS patient opt-out process. 

National Data Opt-out

This applies to identifiable patient data about your health which is called confidential patient information. If you do not want the NDRS to share your confidential patient information, for purposes except your own care, you can register a National Data Opt-out. 

You can find out more about and register a National Data Opt-out or change your choice on the NHS England website. .

The NDRS will keep patient data for as long as it is necessary for the purposes outlined above in accordance with the Records Management Code of Practice 2021 and our Records Management Policy.

Other organisations we share your personal data with must only keep it for as long as is necessary and as set out in their Data Sharing Agreement. Information about this will be provided in their privacy notices on their websites.

The NDRS only stores and processes data within the United Kingdom (UK).

The NDRS has legal permission to collect patient data to use it to protect the health of the population. Previously this permission was granted to Public Health England under section 251 of the National Health Services Act 2006.

On 1 October 2021, permission to collect data on cancer, rare diseases and congenital anomalies was provided to NHS Digital under legal instructions known as Directions, from the Secretary of State for Health and Social Care, under section 254 of the Health and Social Care Act 2012 (2012 Act). The Directions were called the National Disease Registries Directions 2021. They instructed NHS Digital to collect and use confidential patient information to operate the NDRS.   

The NDRS has powers to publish anonymous statistical data under section 260 of the 2012 Act and to share data under section 261 of the 2012 Act. It also has powers to share data, subject to security and privacy safeguards outlined above, under other laws, for example under Regulations 2, 3 and 5 of COPI.

Building on the huge progress made on digital transformation during the pandemic, on the 1 February 2023, NHSD and NHSX merged into NHS England. NHS England is now therefore the controller for the data held by the National Disease Registration Service (NDRS). Find out more about the NHS England merger on the NHS Digital website. 

NHS England is the controller of the personal data held by the NDRS under data protection law.

Under UK GDPR we can only collect and use personal data if we have a legal basis under Articles 6 and 9 of the UK GDPR.

Our legal basis for collecting and analysing personal data is Article 6(1)(c) legal obligation, as we are required to do this to operate the National Disease Registration Services under the National Disease Registries Directions 2021.

As the data we collect is health data, which is a special category of data under UK GDPR, we also need an additional legal basis under Article 9 of UK GDPR. This is Article 9(2)(g) – because the processing of the data is substantially in the public interest and in accordance with the law, for the purposes of NHS England exercising its statutory functions under the National Disease Registries Directions 2021. It is substantially in the public interest to improve NHS cancer treatment and care, improve patient outcomes and to understand the prevalence of congenital anomalies and rare diseases in England and how these are affected by gender, ethnicity, disease type and geographic region. This is also permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018 (DPA).

Our legal basis for sharing patient data under UK GDPR will depend on the organisation we are sharing the data with and how they plan to use it. This will include:

Under Article 6:

• Article 6(1)(c) – where it is necessary to comply with a legal obligation, for example to comply with a Court Order
• Article 6(1)(d) – where it is necessary to protect the vital interests of an individual, for example, where it is necessary to protect a patient’s vital interests
• Article 6(1)(e) – where it is necessary to perform a public task, for example, where we are sharing data with another public authority for the purposes of them exercising their statutory or governmental functions

Under Article 9:

• Article 9(2)(g) – where it is necessary for reasons of substantial public interest, for example where we are sharing data with another public authority for the purposes of them exercising their statutory or governmental functions - this is permitted under paragraph 6 of Schedule 1 of the DPA
• Article 9(2)(h) – where it is necessary for health or social care purposes, for example where we are sharing data with another health or social care body for the purposes of providing you with health care or managing the health and social care system - this is permitted under paragraph 2 of Schedule 1 of the DPA
• Article 9(2)(i) – where it is necessary for public health purposes, for example where we share data with another health or social care body to support the delivery of high standards of quality and safety of health care - this is permitted under paragraph 3 of Schedule 1 of the DPA
• Article 9(2)(j) – where it is necessary for scientific research or statistical purposes, for example where we are sharing data with researchers to carry out health research - this is permitted under paragraph 4 of Schedule 1 of the DPA

You can read more about the health and care information collected by the NHS, and your choices and rights in:

• How we look after your health and care information
• NHS Digital Transparency Notice
• NHS Digital COVID-19 Response Transparency Notice
• How to make a subject access request

Our Data Protection Officer is Jon Moore who can be contacted at [email protected].

We may make changes to this Transparency Notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.