GDPR Compliance

RDaSH takes your confidentiality and privacy rights very seriously, along with its responsibility to ensure compliance with the General Data Protection Regulation (GDPR) (2016).

In order to ensure compliance RDaSH has ensured that amongst other guidance, it has followed the information commissioner’s office (ICO) guidance of “preparing for the general data protection regulations, 12 steps to take now”.

This document outlines how the trust has met each of these standards and what it will do ensure compliance is maintained.

1. Awareness
2. Information you hold
3. Communicating privacy information
4. Individual rights
5. Subject access requests
6. Lawful basis for processing personal data
7. Consent
8. Children
9. Data breaches
10. Data protection by design and data protection impact assessments (DPIA)
11. Data protection officer
12. International

Awareness

RDaSH ensures that all staff within the organisation undertake annual mandatory data security awareness training; the minimum standard allowed for NHS organisations is 95% compliance in this area, with the remaining 5% allowed for staff absences as a result of sickness, maternity or paternity, secondments.

As part of the annual training there is an assessment at the end which each employee must undertake, as well reading and signing the trust’s staff code of conduct, before they are considered compliant.

As well as training, staff are regularly provided with updated information on data protection, best practice, information governance, etc, to ensure a high level of understanding throughout the organisation.

Training is closely monitored by senior management and the trust’s data protection officer. In addition to all of the above the trust’s data protection officer, senior information risk owner and Caldicott guardian receive annual expert training and advise ensuring that their knowledge is maintained at a higher level.

Information you hold

RDaSH undertakes a process which is referred to as data flow mapping. This process identifies:

• all data that flows in and out of the organisation
• for what legal purpose it is collected
• if it is processed securely
• if it is only processed for the purpose in which it was collected
• who data is shared with. This is also linked with information sharing agreements (ISAs)

Information sharing agreement

These agreements define the information that will be transferred between the organisations listed and arrangements for assisting compliance with relevant legislation and guidance. Agreements that set out the lawful basis for the use of personal data by the public sector, across traditional organisational boundaries, to achieve better policies and deliver better services.

The law, rightly, puts in place safeguards for the use of individuals’ data (the data protection act, human rights and common law) and there are organisational costs involved in meeting those conditions. It is important that those safeguards exist and are properly applied.

Data sharing can take place in a way that helps deliver the better services that we all want, while still respecting people’s legitimate expectations about the privacy and confidentiality of their personal information.

What’s next?

This process will continue to be reviewed annually. RDaSH is currently looking to publish this information as part of its openness and transparency, however will need to ensure that by doing so it does not compromise the security of the information held; therefore a summary of data processing activities maybe published. In the interim an outline of data that is processed is available within the trust’s privacy notice.

Communicating privacy information

RDaSH provides a privacy notice as part of it’s your information, your rights page, alongside other information which demonstrates our compliance with GDPR. This includes:

• leaflets and guidance
• individual rights and how these are adhered to
• information sharing agreements (to be published)
• data processing agreements (to be published)
• data protection impact assessments (to be published)

What’s next?

With regard to the documents identified above as “to be published”; RDaSH is currently looking to publish this information as part of its openness and transparency, however will need to ensure that by doing so it does not compromise the security of the information held; therefore a summary maybe provided as an alternative.

Individual rights

RDaSH has published individuals rights on it’s your information, your rights page, along with supporting guidance and leaflets advising on how we will adhere to these rights.

Subject access requests

RDaSH takes its responsibility to provide individuals with their information in accordance with law, very seriously and has a dedicated part of the Information Governance team in place to support this.

If you want to access your personal information, you can make subject access request verbally or in writing. Although if you make your request verbally, we recommend you follow it up in writing, as we have to be satisfied as to your identity, but it will also provide a clear trail of correspondence provide clear evidence of your actions.

Read more about the law and how to make a request.

Lawful basis for processing personal data

Organisations should identify the lawful basis for their processing activity. It should be documented and privacy notices updated. You will see that under the “information you hold” and “communicating privacy information” sections of this page, RDaSH has adhered to this requirement.

Consent

We do not rely on consent to use your information as a legal basis for processing.

We rely on specific provisions under article 6 and 9 of the general data protection regulation, such as either:

• ‘a task carried out in the public interest or in the exercise of official authority vested in the controller’
• ‘the provision of health or social care or treatment or the management of health or social care systems and services’

This means we can use your personal information to provide you with your care without seeking your consent. However, you do have the right to say no to our use of your information, but this could have an impact on our ability to provide you with care.

Where consent is required for data processing, we will ensure that this is explicit, freely given, specific, informed and unambiguous.

Children

For this requirement organisations should start thinking about whether it needs to put systems in place to verify individuals’ ages and to obtain parental or guardian consent for any data processing activity.

RDaSH has had a long history in ensuring that appropriate consent is obtained from children or their parents or guardians.

This is also regularly reviewed to assess that, if the child is considered competent enough, that they then become responsible for their own data and treatment.

Data breaches

RDaSH has systems and processes in place to manage the robust reporting and investigating of data breaches and Incidents. Evidence of this can be found in the trust’s data security and protection breaches or information governance incident reporting policy.

Data protection by design and data protection impact assessments (DPIA)

The General Data Protection Regulation (2016) (GDPR) introduced a new legal obligation to complete a data protection impact assessment (DPIA) before carrying out types of processing likely to result in high risk to individuals’ rights and freedoms. A DPIA is a process to help identify and minimise the data protection risks which requires the processing of personal data. It is also good practice to do a DPIA for any other major project which requires the processing of personal data.

Below is a log of our completed DPIAs, together with their reference number and name of the project, as part of our openness and transparency. To request a copy of the entire DPIA please apply via the FoIA process.

Data protection officer

This trust has appointed a qualified data protection officer:

Caroline J Britten, Data Protection Officer and Head of Information Governance:

• Email: rdash.dpo@nhs.net

International

This trust does not process the majority of its data outside the EU or EEA.

Where this occurs appropriate checks are undertaken, and privacy notices will be updated accordingly.

Page last reviewed: November 19, 2024
Next review due: November 19, 2025