Why we collect your information
We collect your information to ensure colleagues and customers are kept safe from current or potential harm.
What information we collect
- Basic information about you, such as name, address, date of birth, NHS number and next of kin details.
- Information about your health and care which we may require to support you.
- Relevant information pertinent to the safeguarding concern.
We may also process special category information that may include:
- nationality, racial and ethnic origin
- religious or philosophical beliefs
- physical and mental health information
- sex life or sexual orientation
- passport number, if required, in relation to safeguarding concerns in relation to Overseas Healthcare
There may also be instances where concerns potentially involve the families of colleagues and customers and other individuals known to them.
Who we collect your information from
Much of the information we use will be collected directly from you, your family members, NHSBSA colleagues or external agencies.
Sharing your personal information
We may share your personal information with the following external agencies to ensure colleagues or customers to whom they concern are kept safe from current or potential harm:
- GPs
- Other NHS bodies
- Care Providers, such as private sector providers
- Ambulance Trusts
- Local Authorities
- Police
- Integrated Care Board
- Professional Regulators
For safeguarding concerns regarding colleagues, we may share your information with these external agencies and, in addition, internal colleagues such as Human Resources or the Estates Team. We may also share your information with your next of kin.
There may be instances where we may share information without your consent. For example, in an emergency situation, or where it is in the public interest to do so.
How long we keep your information for
We will retain the safeguarding concern record for a period of 7 years.
For more information on the NHSBSA retention periods, read our retention schedule (Excel: 169KB).
Transferring your information outside the UK
We do not routinely transfer your information outside of the UK, unless we are required to refer to the Foreign, Commonwealth and Development Office for any safeguarding concerns abroad. If there is a lawful reason to do this, we would ensure necessary safeguards are put in place.
Your rights
Under UK General Data Protection Regulation (GDPR), data subjects have the following rights in relation to the processing of their personal data:
- To be informed about how we process your personal data.
- Receive a copy of the information we hold about you.
- To request that your personal data is amended if inaccurate or incomplete.
- To request that your personal data is deleted if you believe we are keeping it for longer than necessary.
Version 1 – May 2025