COVID-19 - Privacy Notice


  • Date of issue - 1 May 2020
  • Amended - 8 April 2022
  • Review date - 30 June 2022

The reasons why we use your personal data

This privacy notice describes how we may use your information during the COVID-19 outbreak. It supplements our main privacy notice.

For privacy information relating to testing for coronavirus please see the Department of Health and Social Care.

For privacy information relating to the processing of confidential patient information please see the Secretary of State for Health and Social Care's notice under regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002.

What processing of personal data is undertaken by specific teams or services

Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak.

What information do we collect

We take careful consideration to only collect and use personal information when we need it to deliver a service or meet a requirement.

How we are allowed to use your personal data

Existing law which allows personal information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak.

Using this law the Secretary of State has required the NHS, health organisations and local authorities to share personal information to respond to the COVID-19 outbreak.

Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.

Who we share your personal data with

In order to look after your care needs we may share your personal information with other care providers.

We will also be required to share personal information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak.

Retention of data

Data processing activities for the purposes of COVID-19 will be reviewed on 30 June 2022, unless this is superseded by a stop notice in relation to the COVID-19 public inquiry.

Please see our Retention Schedule and Information Asset Register for information on how long we keep specific data.

Other information

For further information on our privacy notices, please see information and privacy.

Privacy notice amended as per Department of Health and Social Care letter dated 14 February 2022.