Lawful basis for processing

We are required by law to process your information. You can view the lawful basis for each of our services.

 

We are required by law to process your personal data under:

• the Coronavirus Act 2020: Section 9 - Compensation for emergency volunteers
• the Secretary of State for Health and Social Care Notice issued on 20 March 2020 under Regulation 3(4) of the Health Service Control of Patient Information (COPI) Regulations 2002: COVID-19 Purposes

These provide lawful purposes for processing personal data for research, protecting public health, providing healthcare services to the public and monitoring and managing the COVID-19 outbreak and incidents of exposure.

 

We are required by law to process your personal data under National Health Service Act 2006 Section 7.

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in the:

• NHSBSA (Infected Blood Payment Scheme) Directions 2017
• NHSBSA (Infected Blood Interim Compensation Payment Scheme) Directions 2022
• NHSBSA (Infected Blood Interim Compensation Payment Scheme) Directions 2024

Personal data about your health is processed to manage the England Infected Blood scheme.

 

We are required by law to process your personal data under:

• Regulation (EC) Numbers  883/2004, 987/2209, 1408/71, 574/72 and 859/2003
• The Healthcare (European Economic Area and Switzerland Arrangements) (EU Exit) Regulations 2019 SI 2019/1293 and listed Healthcare arrangements
• The National Health Service (Cross-Border Healthcare and Miscellaneous Amendments etc.) (EU Exit) Regulations 2019 SI 2019/777

England

National Health Service Act 2006 Section 7, 8(1), 272(7)-(8) and 273(1).

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in:

• NHSBSA (Establishment and Constitution) (Amendment) Order 2005 Regulation 3
• NHSBSA Directions 2016 (Amendment) Directions 2018 Article 1 and 16
• The NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) (Student Services and Miscellaneous Amendments) and Cross-Border Healthcare (EU Exit) Directions 2020

Wales

National Health Service (Consequential Provisions) Act (Wales) 2006 Sections 23-24, 140(6), 203(10 and 204(3).

The National Assembly for Wales may direct a Special Health Authority to exercise any functions of the National Assembly for Wales or any other person which relate to the health service in Wales and are specified in the NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) (Wales) Directions 2007 Direction 11.

Northern Ireland and Scotland

Health and Medicines Act 1988 Section 7.

 

We are required by law to process your personal data under:

• sections 7, 8, 272(7) and (8) of the National Health Service Act 2006
• sections 13(7) and (8) of the Social Security Act 1988

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified for the Healthy Start service in the following Directions:

The Healthy Start Directions to the NHS Business Services Authority (Awdurdod  Gwasanaethau Busnes y GIG) 2021.

 

We are required by law to process your personal data under the National Health Service Act 2006 Section 13Z(2)(a).

The Board (NHS England) may arrange for any such function to be exercised by or jointly with a Special Health Authority (NHS Business Services Authority) and these are specified in the Pharmaceutical and Local Pharmaceutical Services (Prescriptions, Payments and Listings) Directions 2013 Direction 5.

 

We are required by law to process your personal data under:

• National Health Service (Penalty Charge) Regulations (Wales) 2001 SI 2001/1300
• NHSBSA (Establishment and Constitution) Amendment) Order 2005 SI 2414 Regulation 3
• NHS Commissioning Board & NHSBSA (Primary Dental Services) (England) Regulations 2013
• National Health Service (Personal Dental Services Agreements) Regulations 2005
• National Health Service (General Dental Services Contracts) Regulations 2005
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 – Regulation 3(1) (c), 6 and 9
• National Health Service (Consequential Provisions) Act (Wales) 2006 Sections 23-24, 140(6), 203(10 and 204(3)
• The National Health Service (Primary Dental Services - Miscellaneous Amendments and Directions to the NHS Business Services Authority) Regulations 2016 SI 2016/298
• The Delegation of Additional Functions to the NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) Regulations 2015 SI 127/2015
• The NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) (Wales) Directions 2007 Direction 10

Personal data about your oral health is processed to manage health systems and services.

 

We are required by law to process your personal data under:

• NHS Injury Benefits Regulations 1974 SI 1974/1547
• NHS (Injury Benefits) Amendment Regulations 1985 SI 1985/1626
• NHS Superannuation, Premature Retirement & Injury Benefits (Amendment) Regulations 1991 SI 1991/584
• National Health Service (Injury Benefit) Regulations 1995 SI 1995/866 as amended
• NHS (Injury Benefit) Amendment Regulations 1997 SI 1997/646
• NHS (Injury Benefits) Amendment Regulations 1998 SI 1998/667
• NHS (Injury Benefits) Amendment (No.2) Regulations 1998 SI 1998/2217
• NHS (Pension Scheme, Injury Benefit  & Compensation for Premature Retirement) Amendment Regulations 2003 SI 2003/631
• NHS (Pension Scheme & Injury Benefits) Amendment Regulations 2004 SI 2004/665
• 2005 NHS (Pension Scheme & Injury Benefits) Amendment Regulations 2005 SI 2005/661
• 2005 NHS (Pension Scheme & Injury Benefits) Amendment Regulations 2005 SI 2005/661
• NHS (Pension Scheme, Injury Benefits, Additional Voluntary Contributions & Compensation for Premature Retirement)  (Civil Partnership) Amendment Regulations 2005 SI 2005/3074
• NHS (Pension Scheme, Injury Benefits & Additional Voluntary Contributions) Amendment Regulations 2006 SI 2006/600
• NHS (Pension Scheme, Injury Benefits, Additional Voluntary Contributions & Compensation for Premature Retirement) Amendment Regulations 2007 SI 2007/3280
• NHS Pension Scheme (Additional Voluntary Contributions)& NHS (Injury Benefits &Compensation for Premature Retirement) Amendment Regulations 2008 SI 2008/ 655
• NHS Pension Scheme & Injury Benefits (Amendment) Regulations 2008 SI 2008/2263
• NHS Pension Scheme & Injury Benefits (Amendment) Regulations 2009 SI 2009/381
• NHS Pension Scheme, Injury Benefits, & Additional Voluntary Contributions (Amendment) Regulations 2010 SI 2010 SI 2010/492
• NHS Pension Scheme, Injury Benefits & Additional Voluntary Contributions (Amendment) Regulations 2011 SI 2011/2586
• NHS Pension Scheme & Injury Benefits (Amendment) Regulations 2012 SI 2012/610
• NHS Pension Scheme Additional Voluntary Contributions & Injury Benefits (Amendment) Regulations 2013 SI 2013/413
• NHS Pension Scheme, Additional Voluntary Contributions, Compensation for Premature Retirement & Injury Benefits (Amendment) Regulations 2014 SI 2014/78
• NHS Pension Scheme, Injury Benefits, & Additional Voluntary Contributions (Amendment) Regulations 2015 SI 2015/96
• The National Health Service Pension Scheme, Injury Benefits and Additional Voluntary Contributions (Amendment) Regulations 2016 SI 2016/245
• The National Health Service Pension Schemes, Additional Voluntary Contributions and Injury Benefits (Amendment) Regulations 2019 SI 2019/418
• National Health Service Act 2006 Section 7

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in:

• NHSBSA Directions 2016 Schedule 2 Direction 13 (9) to (18)
• NHSBSA  Directions 2015 Directions 1 and 2
• NHSBSA (Wales) Directions 2007 Direction 8 and schedule 1

Personal data about your health is processed to assess if there are medical reasons why you can receive your NHS Injury benefits as part of managing health systems and services.

 

We are required by law to process your personal data under:

• NHSBSA (Establishment and Constitution) Order SI 2006/632 Regulations 3 (1)
• NHS (Travel Expenses and Remission of charges) (Wales) Regulations 2003 (as amended)
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 – Regulation 3(1) (c), 4, 6 and 9
• NHSBSA (Wales) Directions 2007 direction 9 Schedule 2 paragraph 7 
• NHS (Travel Expenses and Remission of charges) (Wales) Regulations 2003 (as amended)
• NHS (Travel Expenses and Remission of charges) (Scotland) (No. 2) Regulations 2003

 

We are required by law to process your personal data under:

• National Health Service (Charges for Drugs and Appliances) Regulations 2015 - Regulation 10, 15
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4,6 and 9

Personal data about your health is processed to manage health systems and services.

 

We are required by law to process your personal data under:

• The National Health Service (Charges for Drugs and Appliances) Regulations 2015 - Regulation 10 and 15
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4,6 and 9

Personal data about your health is processed to manage health systems and services.

 

We are required by law to process your personal data under:

• Finance Act 2004 Section 252(1)
• The Public Service Pension Act  2013
• National Health Service Act 2006 Section 7
• NHS Pension Regulations

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in:

• NHSBSA (Establishment and Constitution) (Amendment) Order 2005 Regulation 3
• NHSBSA Directions 2016 Schedule 2 Direction 13 (9) to 13 (18) and Schedule 3
• NHSBSA (Wales) Directions 2007 Direction 8 and schedule 1
• NHSBSA (Wales) (Amendment) Directions 2014

Personal data about your health is processed to assess if there are medical reasons why you can receive your NHS Pension benefits earlier.

 

We are required by law to process your personal data under:

• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4 and 9
• National Health Service Act 2006 Section 7

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in:

• NHSBSA Pharmaceutical & LPS Directions 2013
• NHSBSA Directions 2006 Directions 5, 6 and 7
• The National Health Service (Pharmaceutical Services, Charges and Prescribing) (Amendment) Regulations 2018 SI 2018/1134

Personal data about your health is processed to manage health systems and services.

 

We are required by law to process your personal data under Tax Credits (Provision of Information) (Functions Relating to Health) Regulations 2003 SI 2003/731 - Paragraph 9.

We also have a contract with HM Revenue and Customs under:

• Tax Credits Act 2002 Schedule 5
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4,6 and 9

 

We are required by law to process your personal data under:

• NHSBSA (Establishment and Constitution) Order SI 2006/632 regulation 3 (1)
• The National Health Service (Charges for Drugs and Appliances) Regulations 2015 - Regulation 10, 16 and 17 
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4 and 9

 

We are required by law to process your personal data under National Health Service Act 2006 Section 7.

The Secretary of State may direct a Special Health Authority to exercise any functions of the Secretary of State or any other person which relate to the health service in England and are specified in the following Directions:

• NHSBSA Directions 2016 Schedule 2 Direction 13 (1) to 13 (8)
• NHSBSA (Establishment and Constitution) (Amendment) Order 2005 Regulation 3
• NHS Bursary, NHS Learning Support Fund and Social Work Bursary Schemes Directions 2020
• The NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) (Student Services and Miscellaneous Amendments) and Cross-Border Healthcare (EU Exit) Directions 2020 Direction 4

Personal data about your health is processed as required by employment law to assess your capacity to work.

Personal data relating to equality and diversity is processed to make sure we meet equality laws.

 

We are required by law to process your personal data under the Vaccine Damage Payments Act 1979 as amended by subsequent regulations including The Vaccine Damage Payments (Specified Disease) (Amendment) Order 2021 SI 2021/508.

The NHS Business Services Authority (Vaccine Damage Payments Scheme) Directions 2021.

We are required by law to process your personal data under:

• NHSBSA (Establishment and Constitution) Order SI 2006/632 regulation 3 (1)
• The National Health Service (Charges for Drugs and Appliances) Regulations 2015 - Regulation 10, 16 and 17a
• Social Security (Information-sharing) (NHS Payments and Remission of Charges etc.) (England)) Regulations 2015 SI 2015/124 - Regulation 3(1) (c), 4 and 9