COVID-19 - Privacy Notice


  • Date of issue - 1 May 2020
  • Amended - 26 July 2021
  • Review date - 30 September 2021


The reasons why we use your personal data

This privacy notice describes how we may use your information during the COVID-19 outbreak. It supplements our main privacy notice.

For privacy information relating to testing for coronavirus please see the Department of Health and Social Care.

For privacy information relating to the processing of confidential patient information please see the Secretary of State for Health and Social Care's notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002.

If staff absence creates a significant risk to the health or safety of patients or service users, then social care and primary care staff whose activities are critical to the ongoing provision of the service, and who have identified as a contact of a case of COVID-19, may be able to attend work rather than self-isolate, as set out in Covid-19: management of staff and exposed patients or residents in health and social care settings guidance.

In Surrey a COVID-19 self-isolation exemption decision process and application tool has been developed to manage staff self-isolation exemption requests and authorisations for social care and primary care staff who work in Surrey. This process will be in place until the 16th August 2021.

What processing of personal data is undertaken by specific teams or services

Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak.

What information do we collect

We take careful consideration to only collect and use personal information when we need it to deliver a service or meet a requirement.

How we are allowed to use your personal data

Existing law which allows personal information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak.

Using this law the Secretary of State has required the NHS, health organisations and local authorities to share personal information to respond to the COVID-19 outbreak.

Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.

Who we share your personal data with

In order to look after your care needs we may share your personal information with other care providers.

We will also be required to share personal information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

Retention of data

Data processing activities for the purposes of COVID-19 will be reviewed on 30 September 2021.

Please see our Retention Schedule and Information Asset Register for information on how long we keep specific data.

Other information

For further information on our privacy notices, please see information and privacy.

Privacy notice amended as per Department of Health and Social Care letter dated 27 January 2021.