Fair Processing Notice

Fair Processing Notice (under the General Data Protection Regulation)

This Fair Processing Notice informs all of our users of how we use personal information, who we share information with and how we maintain patient confidentiality. For further information, please see our information leaflet: IL137 How we use and look after your information.

1. Identity and Contact Details of the Controller

Gateshead Health NHS Foundation Trust
ICO Registration No: Z5014607
Gateshead Health NHS Foundation Trust
Queen Elizabeth Hospital, Queen Elizabeth Avenue
Sheriff Hill, Gateshead, NE9 6SX

2. Purpose and legal basis for the processing

This Fair Processing Notice informs all of our users of how we use personal information, who we share information with and how we maintain patient confidentiality. It applies to:-

  • Patients
  • Employees
  • Complaints
  • Enquirers
  • National Surveys and Audits
  • Individuals captured by CCTV images

3. Patients

Purpose of the Processing

At Gateshead Health NHS Foundation Trust we collect and process personal data on a daily basis in order to deliver the best possible services and outcomes to our users. This is essentially a daily part of our role. Records are kept in physical and electronic format to cover areas such as:

  • Basic details about you for example your address and next of kin, contacts, status etc
  • Details about your treatment care and support that you need and receive 
  • Investigation results notes and reports such as x-rays and laboratory tests
  • Relevant information from other health and social care professionals  relatives or those who know you and know you well.

We collect your information because it helps us to:

  • Confirm who you are and when we can contact you;
  • Make decisions about your ongoing care and treatment;
  • Administer and check your care is the right type and is safe and  effective;
  • Ensure that our healthcare professionals have accurate and up to date information to assess your needs and improve your care/treatment;
  • Ensure appropriate information is available should you be referred to other specialists/GPs or another part of the NHS, Social Care or Health Provider;
  • Allows us to investigate any concerns or complaints that you make against us.

It is essential that your details are accurate and up to date to avoid any mistakes. Patients should always check that their details are up to date and inform us of any changes as soon as possible.

Information Sharing

The Trust works in partnership with a number of NHS and Non-NHS organisations to deliver joined up integrated services to users. This may involve the Trust routinely sharing information with third parties where there is a genuine need for the information to be shared where there is a legal basis or patient consent has been provided.

Principal organisations we share information with include:

  • NHS Trusts involved in your care
  • GP’s
  • Ambulance Services
  • Private sector providers who work with the Trust.

Subject to stricter agreements it may also include:

  • Adult and Children Services
  • Care Homes 
  •  Local Authorities
  •  Education Establishments
  •  Voluntary Sector Providers.

We We may also share anonymised data with Clinical Commissioning Groups for performance and commissioning purposes. Users are informed that the Trust has a legal obligation to share data where it is in respect of:

  • The notification of births
  • Where a formal court order has been served on us
  • To third parties such as the Police, the Department of Work and Pensions and anti-fraud agencies where it is for the purpose of the prevention and detection of crime and fraud
  • Where there is a need to protect the public interest
  • Where there is a need to protect vulnerable children and adults
  • Health and Safety purposes for example infectious diseases such as meningitis, measles etc.

Personal information is sometimes used to audit and manage the NHS and to help us protect the health of the public. Your information may be used to:

  • Audit our NHS services
  • Prepare statistics for NHS performance
  • Review the care we provide to ensure that it is of the highest standards
  • Investigate patient queries, audits, inspections, complaints and legal claims
  • Make sure our services can meet patient’s needs in the future for example service planning and service evaluations
  • Help educate and train our healthcare professionals

 Legal Basis

The Legal basis for the processing is covered under Article 6 (1)(e) of the General Data Protection Regulation where “processing is necessary for the performance of a task carried out in the public interest  or in the exercise of official authority vested in the controller” and Article 9 (2)(h) where “processing is necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee medical diagnosis the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union Or Member State law or pursuant to contract with a health professional”.

Disclosure of information

Sensitive personal information may be used in the following cases:

  • The information is necessary for your direct healthcare.
  • We have received consent from individuals to be able to use their information for a specific purpose.
  • There is a legal requirement that will allow us to use or provide information.
  • We have special permission called a “Section 251 agreement” (Section 60 of the Health and Social Care Act 2001 as re-enacted by Section 251 of the NHS Act 2006) which allows the Secretary of State for Health to make regulations to set aside the common law duty of confidentiality for defined medical purposes. Further information can be found on the Health Research Authority’s website https://www.hra.nhs.uk/

If you have any queries please contact your clinician or the Trust Data Protection Officer whose contact details are at the end of this notice. 

Research and Development

Research plays a pivotal role in the development of the health care service and in the delivery of the Trust services. The Trust is a proactive research institution which is reflected in our aims and values.

All research studies that involve the use of patient data for secondary purposes are required to present their trial and have their study approved by the Trusts Research and Ethics Committee before it takes place to ensure it is appropriate and worthwhile.

Users are always asked if they want to directly participate in the trial. In these circumstances the Trust will always ask you for your express consent and inform you how your information will be used unless legislation permits use.


The Trust uses third party companies to assess images and obtain diagnosis outcomes from clinicians for direct patient care. The companies act as data processors for the Trust and comply with the requirements of the General Data Protection Regulation and Data Protection Act 2018. The companies are 4Ways Healthcare, Everlight Radiology and MSI Reporting.

Access to these images are enabled for healthcare professionals in the provision of care and all companies are covered by contract as required.


4. Employees, Volunteers and Job Applicants 

Purpose of the Processing

During the course of its employment activities, Gateshead Health NHS Foundation Trust collects, stores and processes personal information about prospective, current and former staff. This Privacy Notice includes applicants, employees (and former employees), workers (including agency, casual and contracted staff), volunteers, trainees and those carrying out work experience. 

Purposes of processing include:-

Staff administration and management (including payroll and performance), Pensions administration, Business management and planning, Accounting and Auditing, Accounts and records, Crime prevention and prosecution of offender, Education, Health administration and services, Information and databank administration and the Sharing and matching of personal information for national fraud initiative.

The types of information handled for the purposes of employment include:-

Personal demographics (including gender, race, ethnicity, sexual orientation, religion), Contact details such as names, addresses, telephone numbers and Emergency contact(s) , Employment records (including professional membership, references and proof of eligibility to work in the UK and security checks), Bank details, Pension details, Medical information including physical health or mental condition (occupational health information), Information relating to health and safety, Trade union membership, Offences (including alleged offences), criminal proceedings, outcomes and sentences, Employment Tribunal applications, complaints, accidents, and incident details.

We have a legal basis to process this as part of your contract of employment (either permanent or temporary) or as part of our recruitment processes following data protection and employment legislation. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing.  Your information is never collected or sold for direct marketing purposes and is not processed overseas.

Employment Process

Gateshead Health NHS Foundation Trust is the data controller for all information you provide as part of the employment process unless otherwise stated. If you have any queries about how we handle your information please contact us at ghnt.workforceinformation@nhs.net

All of the information provided to the Trust will only be used for the purposes of progressing your application or in certain circumstances to fulfil legal regulatory requirements if necessary.

We will not share your information you provide during the recruitment process for marketing purposes or store any of your information outside of the European Economic Area. The information you provide will be held securely by us and/or our data processors whether the information is in electronic or physical format. We will use the contact details you provide to us to contact you to progress your application. We will use the other information you provide to assess your suitability for the role you have applied for.

Information is provided through NHS jobs which is collated by Gateshead NHS Foundation Trust for the purposes of administering recruitment.

Legal Basis

Staff personal data is held by Gateshead Health NHS Foundation Trust for the purpose of administering the employment of its staff.  The legal basis for processing this data is based on Article (6)(1)(c) and Article (9)(2)(b) of the General Data Protection Regulation.  Any other use will be explained at the point of collection with the relevant statutory provisions.

 Disclosure/Sharing Information

The data is held for employment purposes by the Trust and will only be transferred to third parties where there is an established legal basis to do so with the appropriate safeguards in place. This may include but is not limited to statutory bodies such as the Care Quality Commission and Health and Safety Executive or regulatory bodies such as the General Medical Council, Nursing and Midwifery Council or the Health and Care professions Council where applicable.

There are a number of reasons why we share information.

  • Our obligations to comply with legislation
  • Our duty to comply with any Court Orders which may be imposed.

 Any disclosures of personal data are always made on a case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances, along with appropriate security controls in place.  Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the disclosure of your personal data to such persons.

To enable effective staff administration Gateshead Health NHS Foundation Trust may share your information with external companies to process your data on our behalf in order to comply with our obligations as an employer. The Trust utilises Northumbria Healthcare NHS Foundation Trust Payroll as its payroll service who process data on employees.

The information which you provide during the course of your employment (including the recruitment process) will be held on the national NHS Electronic Staff Record (ESR) system.

We may use the information we hold about you to detect and prevent crime or fraud. We may also share this information with regulatory bodies such as the General Medical Council (GMC), Nursing and Midwifery Council (NMC), Health and Care Professions Council (HCPC) and other bodies that inspect and manage public funds where applicable.

We will not routinely disclose any information about you without your express permission. However, there are circumstances where we must or can share information about you owing to a legal/statutory obligation.

5. Complaints/Enquirers

When the Trust receives a complaint from a person we make up a file containing the details of the complaint. This will normally contain the identity of the complainant and any other individuals involved in the complaint. This is based on the consent of the individual as the relevant legal basis under Article 6(1)(a) and Article 9(2)(a).

6. National Surveys and Audits

The Trust carries out National Surveys and Audits which allow us to manage our services, prepare statistics on our performance and review the care we are providing by ensuring we are meeting patients’ needs and national NHS obligations. If you would like to opt out of taking part in surveys and audits please contact the Trust Data protection Officer and your views will be respected. The following websites offer more information:

NHS Surveys website
National Patient and Staff surveys
Clinical Audit webpage 

 We may use your contact details to conduct this survey under the relevant legal basis which in this case is paragraph 1(e) of Article 6 and “a task carried out in the public interest”.

7. Complaints

The Trust aims to meet the highest standards when collecting and using personal information and we take any complaints we receive very seriously. We encourage people to bring concerns to our attention if they think that our collection or use is unfair misleading or inappropriate. Please contact the Trust using the contact details above if you have any such concerns.

Information will be held for the purposes of the complaint with your consent and will be used in the investigation and as part of any necessary enquiries.

8. Individuals captured by CCTV images

The Trust outsources its CCTV provision to QE Facilities which acts as a data processor for the Trust. These images are stored in a secured area and are only accessible by authorised staff and are deleted after 31 days.

9. General Rights regarding information held by the Trust

Data Retention

Patient and Employment data will be retained in compliance with the Records Management Code of Practice for Health and Social Care 2016 which details retention periods for employment records. This is available on the NHS Digital website at: 

NHS Records Management Code of Practice.

Individuals Rights

All patients staff has the right to request access to their employment data under subject access provisions of the General data Protection Regulation.

To make a request to Gateshead Health NHS Foundation Trust you will need to put in a request in writing addressing it to our Disclosures Team in Health Records. Further details are available from the Disclosures team website which is available from the following link – Health Records Disclosures.

Other rights include: 

  • To be informed why, where and how we use your information.
  • To ask for access to your information.
  • To ask for your information to be corrected if it is inaccurate or incomplete.
  •  To ask for your information to be deleted or removed where there is no need for us to continue processing it.
  • To ask us to restrict the use of your information.
  • To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.
  • To object to how your information is used.
  • To challenge any decisions made without human intervention (automated decision making).
  • The right to withdraw consent where relevant

These rights apply in circumstances where relevant conditions are met.  Please visit our website (https://www.qegateshead.nhs.uk/) for further details on this.

10. Contacts

If you have any further queries on the uses of your information, please contact:

Data Protection Officer
Post: c/o Information Governance Team
Trust HQ,
Queen Elizabeth Hospital
Sherriff Hill,
NE9 6SX 

E mail: ghnt.ig.team@nhs.net

Telephone: 0191 445 8418

If you are not content with the outcome of your confidentiality and data protection concern/complaint raised with the Trust you have the right to apply directly to the Information Commissioner for a decision. 

Information Commissioner’s Office (ICO) 

Post: Information Commissioner’s Office

Wycliffe House, Water Lane

Wilmslow, Cheshire       


Email:                    casework@ico.org.uk

Telephone:         0303 123 1113 (Local Rate) or +44 1625 545 745 (outside UK)


Call us on 0191 482 0000

In emergencies dial 999 / Non-emergencies dial 111

By continuing to use the site, you agree to the use of cookies. You can change this and find out more by following this link.
Accept Cookies