GDPR Data processing modelOrganised cancer screening

PublicHealth

This processing involves collecting, managing, sharing, and retaining personal and health data for population-based cancer screening programmes (e.g. breast, bowel, cervical) operated under NHS and UKHSA authority, including invitation, follow-up, and programme evaluation.

Purposes (4)

A purpose is the objective pursued by the setting up of your file. It indicates what the processing of personal data will be used for, its purpose. This purpose must be clear and understandable

Follow-up operations and result transmission

Including transmission of screening test results

Public interest

Art. 6(1)(e) Public task & Art. 9(2)(h) – carried out by NHS as part of healthcare provision. Covered by NHS screening governance.

Programme evaluation

Legitimate interest

Art. 6(1)(f) Legitimate interests (public benefit) & Art. 9(2)(j) – for public health statistics and research.

Identification and invitation of eligible persons

Files of persons constituted from data transmitted by participating health insurance funds, for the purpose of inviting people to screening operations according to their eligibility criteria

Public interest

Art. 6(1)(e) & Art. 9(2)(h) – necessary for delivery of public screening under NHS mandate.

Coordination with physicians and reading centres

Public interest

Art. 6(1)(e) & Art. 9(2)(h) – for continuity of care and transmission of results.

Data categories (3)

Personal data is any information relating to an identified or identifiable natural person. A natural person can be identified either directly (eg surname and first name) or indirectly (eg phone number, social security number, email or postal address, but also voice or image)

Healthcare professionals’ identification data

Data details

Healthcare professional registration number

optional

Postal Addressrequired

Name and surnamerequired

Data conservation rules

Active base:

Until end of programme participation

Aligned with role-based access policies in NHS Digital

Intermediate archiving:

Not applicable

Destruction

Patients’ identification and health data

Data details

Telephone numberrequired

Date of birth

required

Genderrequiredsensitive data

Name and surnamerequired

National Insurance numberrequiredsensitive data

Data conservation rules

Active base:

Until end of clinical follow-up (set by clinician or patient)

NHS Records Management Code of Practice (2021) states screening records should be retained up to 10 years after last action or longer if clinically necessary. https://transform.england.nhs.uk/information-governance/guidance/records-management-code/

Intermediate archiving:

Reviewed after 10 years

Retention aligned with Section 5.5 of NHS Records Code (2021): 10 years from last clinical contact unless otherwise clinically required.

Destruction

Data subjects' health data

Data details

Care delivery informationrequired

Date results sent to doctor and personrequiredsensitive data

Medical imaging imagesrequiredsensitive data

Reason for refusal to participate in the programoptional

Medical Historyrequiredsensitive data

Medical Examination Resultsrequiredsensitive data

Identification number within the hospital structurerequired

Data conservation rules

Active base:

Until end of clinical follow-up (set by clinician or patient)

Intermediate archiving:

Reviewed after 10 years

Retention aligned with Section 5.5 of NHS Records Code (2021): 10 years from last clinical contact unless otherwise clinically required.

Destruction

Data subject (2)

A data subject is any person whose data is collected, retained or processed by the data processing. e.g. In a recruitement process, any candidate for a position proposed in recruitement management process

Healthcare Professionals
Patients

Created at:07/08/2023

Updated on:07/07/2025

Nb using:2

GDPR Data processing modelOrganised cancer screening

Purposes (4)

Data categories (3)

Healthcare professionals’ identification data

Patients’ identification and health data

Data subjects' health data

Data subject (2)

Access the full processing template