- • and regulatory bodies (e.g. Nursing and Midwifery Council (NMC), • and regulatory bodies (e.g. Nursing and Midwifery Council (NMC), Health and Care Professions Council (HCPC), General Medical Council (GMC) in relation to the confirmation of conduct including complaints, job description and information provided as part of the recruitment process.
- • departments and agencies where we have a statutory obligation to • departments and agencies where we have a statutory obligation to provide information (e.g. HMCR, NHS Digital, Department of Health and the Home Office)
- • Disclosure and Barring Service (DBS) and DBS Update Service where we • Disclosure and Barring Service (DBS) and DBS Update Service where we require a DBS check for certain roles
- • parties who work with us to provide staff support services (e.g. counselling) • parties who work with us to provide staff support services (e.g. counselling)
- • prevention or detection agencies (e.g. the police, security organisations, • prevention or detection agencies (e.g. the police, security organisations, department for works and pensions and local authorities)
- • and external auditors • and external auditors
- • collection and tracing agencies • collection and tracing agencies
- • and tribunals • and tribunals
- • union and staff associations • union and staff associations
- • organisations for example for the annual staff survey • organisations for example for the annual staff survey

Any disclosures of personal data are always made on case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Information is only shared with those agencies and bodies who have a "need to know" or where you have consented to the disclosure of your personal data to such persons.

#### Legal Basis for processing your data

The Practice will only ever process your personal information where it is able to do so by law and using one of a number of legal basis available under the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR). The legal bases we use are as follows:

### Special Category data (Sensitive Data including Health Records)

- • consent • consent
- • social security and social protection (if authorised by law) • social security and social protection (if authorised by law)
- • interests – Life and Death • interests – Life and Death
- • public by the data subject • public by the data subject
- • claims or judicial acts • claims or judicial acts
- • of substantial public interest (with a basis in law) • of substantial public interest (with a basis in law)
- • or social care (with a basis in law) • or social care (with a basis in law)
- • health (with a basis in law) • health (with a basis in law)

### For personal data

- • the individual has given clear consent to process their personal data for a • the individual has given clear consent to process their personal data for a specific purpose.
- • the processing is necessary for a contract you have with the individual, or • the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
- • obligation: the processing is necessary for you to comply with the law (not • obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
- • interests: Life & Death • interests: Life & Death