Skip to main content Skip to footer

Privacy notice: Challenge your Penalty Charge Notice

The NHS Business Services Authority (NHSBSA) is responsible for this online service.

To check if we have your details, we will ask you to enter your:

  • Penalty Charge Notice (PCN) reference number
  • date of birth
  • PCN value total amount

If there is a discrepancy in the details we hold, we will ask you to enter your:

  • full name
  • date of birth
  • address

If you are making a payment, we will ask you for credit/debit card details to process your payment.

Sharing your personal information

If you are making a payment, we will share your information with our payment providers Capita Business Ltd or Govpay, who meet all card security requirements. We receive proof whether payment was successful but not your card details.

Why we process your information

We’ll use the information you enter to:

  • establish if you held a valid exemption at the time of your prescription or dental treatment charge
  • state the steps you need to follow to action your PCN
  • contact you by your preferred contact method to discuss your PCN, if appropriate
  • signpost you to help with health costs in the future.
  • update your customer record, where appropriate

We only hold the information you enter for 30 minutes after you close your browser. 

Find out more about your rights and how we process information.


Our website places small files, known as cookies, onto your device.  Cookies measure how you use our website so we can update and improve it based on your needs. 

Find out how to manage cookies.

What cookies we use and why

Google Analytics cookie

We use Google Analytics software to collect information about how you use our website. 

Google Analytics collects information about:

  • the pages you visit and how long you spend on them
  • how you got to the service
  • what you click on when you’re using the service

You can opt out of Google Analytic tracking across all websites.

Google Analytics uses the following cookies:

Cookie name Purpose How long it stays on your device
_utma To determine the number of unique visitors to our website 2 years
_utmb To establish and continue your internet browser session on our website 30 minutes
_utmt To manage data transfer volumes 10 minutes
_utmz To determine where you came from when visiting our website 6 months
_ga To distinguish users 2 years
_gid To distinguish users 24 hours
_gat To manage data transfer volumes 10 minutes
_utmc To determine whether the user was beginning a new session/visit Until you close your browser
_utmv To store information about your visit to our webpages. This is updated every time information is sent to Google Analytics. 2 years after the last update

What this service uses

Cookie name Purpose How long it stays on your device
JSESSIONID This cookie is essential for these systems to work Until you close your browser