The Trust collects, stores and processes personal information about prospective, current and former staff and workers to ensure compliance with legal or industry requirements.

The NIHR infrastructure will collect and process information related to employees or workers to fulfil its contracted research objectives and allow employees to be contacted about, and benefit from, activities on offer across its collaborative networks. This could include training, invitations to workshops or events and the opportunity to apply for specific funding offered as part of the NIHR contracts.

Processing of employee/workers personal information is necessary for the purposes of carrying out the obligations and exercising specific rights of the data controller (the Trust) or of the data subject (staff member/worker) in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject.

The Trust does not require consent or explicit consent of employees/workers to process personal data if the purpose falls within the legal basis detailed above.

You can find further information on this legislation on the website below.

UK Legislation Website

Personal information about you will largely be collected directly from you during your recruitment and contract.

Personal information may also be collected from employees/workers in certain circumstances, through routine update checks such as professional registration and DBS clearances.

In addition, personal information could be collected by the Oxford Health NIHR infrastructure for obligations connected to its research activity or opportunities offered through the collaborative NIHR networks.

In order to carry out our activities and obligations as an employer we handle data in relation to:

• Personal demographics (including gender, race, ethnicity, sexual orientation, religion, socio-economic background, Date of birth)
• Contact details such as names, addresses, telephone numbers and emergency contact(s)
• Employment checks as per NHS Employers standards
• Employment history and reference checks
• Proof of eligibility to work in the UK
• Bank details
• HMRC details (to include tax code)
• Pension details
• Occupational health information (medical information including physical health, mental conditions and vaccination status e.g. flu, COVID or any other required vaccination)
• Health and safety
• Employment Tribunal applications, complaints, accidents, and incident details
• When you work
• Training that you have undertaken

Personal information is processed for the purposes of:

• Staff administration and management
• Workforce management
• Payroll administration
• Pensions administration
• Registration to NHS Care Identity Service
• Communication in the event of an emergency and/or welfare check.
• Workforce Planning and Talent Management.

We will not routinely disclose any information about you without your express permission. However, in order to enable effective administration and comply with our obligations as your employer, we will share the information which you provide during the course of your contract (including the recruitment process) with the NHS Business Services Authority for maintaining your employment records, held on systems including the national NHS Electronic Staff Record (ESR) system.  Data may also be shared with other NHS bodies including NHS England and the Integrated Care Board as well as partners with whom we have joint service agreements such as Mind and Oxford University Hospitals.

Personal data will be held securely on systems provided by third party suppliers which meet the NHS digital, cyber security and GDPR standards.

Any disclosures of personal data are always made on a case-by-case basis, using the minimum personal data necessary for the specific purpose and circumstances and with the appropriate security controls in place. Personal Information is only shared with those agencies and bodies who have a “need to know” or where you have consented to the disclosure of personal data to such persons.

Where possible, we will always look to anonymise/ pseudonymise personal information so as to protect confidentiality, unless there is a legal basis that permits us to use it, and will only ever use/ share the minimum information necessary. However, there are occasions where the Trust is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

For any request to transfer personal data internationally outside the UK/EU we will make sure that an adequate level of protection can be satisfied before the transfer.

There are a number of circumstances where we have a legal duty to share information about you to comply or manage with:

• Disciplinary/ investigation processes; including referrals to Professional Bodies, e.g. NMC and GMC
• Legislative and/or statutory requirements
• Court Orders which may have been imposed on us
• NHS Counter Fraud requirements
• Request for information from the police and other law enforcement agencies for the prevention and detection of crime and/or fraud if the crime is of a serious nature

As a Trust we do use third party providers to facilitate your employment with OHFT who require us to share personal information, for example:

• Our Payroll provider, Salisbury NHS Trust
• Our DBS provider, CareCheck
• Our Staff Survey Processer, Picker Institute Europe

We take security and confidentiality very seriously. Employees and workers are required to abide by Trust Policy which defines the strict codes of conduct expected from anyone accessing personal information about you, and participate in regular Information Governance training and workshops at Trust Induction.

personal information about you is held in both paper and electronic forms for specified periods of time as set out in the NHS Records Management Code of Practice for Health and Social Care and National Archives Requirements.

NHS Records Management Code of Practice

We hold and process personal information in accordance with the Data Protection Act 2018  and UKGDPR 2021, as explained above. In addition, everyone working for the NHS must comply with the Common Law Duty of Confidentiality and various national and professional standards and requirements.

OHFT takes Cyber Security seriously and has dedicated teams of people who are regularly reviewing and updating security to the Trusts Confidential and Personal data both about the Trusts patients, staff and workers.

We have a duty to:

• maintain full and accurate records related to your employment
• keep records about you confidential and secure
• provide information in a format that is accessible to you

If we need to use information about you for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. The Data Protection Act 2018 and UKGDPR  gives you certain rights, including the right to:

• Request to access the personal data we hold about you, e.g. personnel records.
• Request the correction of inaccurate or incomplete information recorded in our records, subject to certain safeguards. Contact the Human Resources Department, contact details below, for further information
• Request that information about you be deleted or removed where there is no need for us to continue processing it and where the retention time has passed;
• Ask us to restrict the use of information about you where appropriate
• Ask us to copy or transfer information about you from one IT system to another in a safe and secure way, without impacting the quality of the information
• To object to how information about you is used.

If you wish to access the personal data we hold about you, please contact the Trust’s Human Resources Department.

Please remember to include details of the information you require plus contact details and two forms of identification such as a copy of your driving license/ passport and also a document with your name and address on such as a utility bill.