Lawful for processing personal data Article 6(1)(e) of the GDPR. Necessary for the performance of a task in the public interest. Special category of personal data Yes, health data and DBS checks, as appropriate Basis for processing special category of data Article 9(2)(b) ‘is necessary for the purposes of carrying out the obligations and exercising the specific rights … in the of employment …social law protection in so far as it is authorised in the Union or Member State law…’ for health data [Article 10 and Section 9 and 10 of the Data Protection Act 2018 for DBS checks] How is data collected? From employees and referees. How is data stored? How long is data stored? (e.g. term of employment and 7 years) To whom do you provide the data (recipients)? (including processors) (company which is a processor for payroll purposes only) Date confirmed that this applies to your pharmacy Template C continued Activity: Purpose Lawful basis for processing personal data Special category of personal data
You have the to confidentiality under the General Data Protection Regulation and [the Data Protection Act 2018] and the common law duty of confidence. We also comply with the NHS Code of Practice on Confidential Information and pharmacists have a requirement under their professional standards to keep records about you confidential, secure and accurate. All of our staff contracts of employment contain a requirement to keep patient information confidential. [You may choose to opt out of the NHS using your data for planning and research purposes – please ask for details.] Our guiding principle is that we process your records in strict confidence. Your right to view your health record You have the right to ask for a copy of all pharmacy records about you (generally in paper or electronic form). Generally, there will be no charge for a printed copy of the information we hold about you. We are required to respond to your request within one month. You will need to give adequate information in order for pharmacy staff to identify you (for example, full name, address and date of birth). You will be required to provide ID, for example a passport, full driving licence or credit/debit card before any information is released to you. If you think any information we hold on you is inaccurate or incorrect, please let us know. You may object to us holding your information. You may lodge a complaint with the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. [Our Data Protection Officer is (name and contact details)] How we look after and safeguard information about you
Incidents should be classified in the log according to the severity of risk to patients and the pharmacy using the following incident classification system described below. For consider the likely impact if the breach had occurred. You must document any personal data breaches, as even if they are not notified to the ICO. The ICO may inspect your records to verify you are keeping such records. Incident or personal data breach classification: Insignificant: (very low risk) Minimal risk effect on patients or the pharmacy Not reported to ICO No patients informed Recorded as a personal data breach (low risk) Minor breach, for example data lost but files encrypted, less than 5 patients affected Not reported to ICO No patients informed Recorded as a personal data breach Moderate: (Likely to result in a risk to the rights and freedoms of patients) Moderate breach, for example unencrypted clinical records lost, up to 20 patients affected Reported to ICO Communication to patients considered Recorded as a personal data breach Major: (Consider whether likely to result in a high risk to the rights and freedoms of patients) Serious breach, for example unencrypted clinical records lost, up to 1,000 patients affected or particular sensitivity Reported to ICO Communication to patients considered Recorded as a personal data breach Critical: (Likely to result in a high risk to the rights and freedoms of patients) Serious breach in terms of volume of records, for example over 1,000 patients affected or particular sensitivity of records Reported to ICO Communication to patients likely Recorded as a personal data breach