Privacy notice for Report an outbreak
About UKHSA
On 1 October 2021, the UK Health Security Agency (UKHSA) came into being. An executive agency of the Department of Health and Social Care (DHSC), UKHSA combines many of the health protection activities previously undertaken by Public Health England (PHE), together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre (JBC).
The processing activities previously undertaken by these organisations and their associated data processors have not changed with the establishment of UKHSA. Individual rights are not affected by this change.
We are responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as internationally. UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats.
We collect and use personal information to fulfil our remit from the government.
UKHSA’s responsibilities include providing the Report an outbreak service. Read about UKHSA’s responsibilities in the UKHSA strategic plan 2023 to 2026 (opens in new tab).
The 'Report an outbreak' service enables Adult Social Care (ASC) providers to report outbreaks of acute respiratory infection (ARI) like flu or COVID-19. It automates the outbreak risk assessment process and provides immediate relevant outbreak management advice to the setting via email.
This privacy notice explains what personal information we collect, use and may share for Report an outbreak. It explains what your rights are if we hold your personal information, and how you can find out more or raise a concern.
DHSC is the data controller for the personal information we collect, store and use to fulfil our remit.
The information we collect
During an outbreak, the local health protection team needs to collect personal information so they can quickly provide the care setting with relevant outbreak management advice.
The personal information we collect and use includes the reporter’s (and an optional additional contact person’s):
- full name
- job title
- work address
- telephone number
- email address
- computer IP address
How we collect your information
This personal information comes from the person in the ASC setting that reports the outbreak.
The purposes we use your information for
We triage and interpret outbreak reports to prioritise and minimise the impact of outbreaks.
We use your information to contact you to provide advice and support to help you manage your outbreak.
We work with local authority health protection teams to make sure the local advice and support you receive is coordinated.
How we protect your information
The personal information used by Report an outbreak is protected in a number of ways.
It is stored on computer systems that have been tested to make sure they are secure and which are kept up to date to protect them from viruses and hacking. Where we share your personal information with other organisations, we only ever do so using secure computer systems or encrypted email.
Your information used by us can only be seen by staff who have been specifically trained to protect your privacy. Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.
Whenever possible, we only use your information in a form that does not directly identify you.
No information that could identify individual people is ever published by UKHSA.
Where we store your information
All personal information used by Report an Outbreak is held in the UK only.
Who we share your information with
We may share your personal information with other organisations to support the service. If we do share your personal information, we only do so where the law allows and we only share the minimum necessary amount of information.
With local authorities
Local authorities and mayoral and combined local authorities have responsibilities for protecting the health of their residents. We share information from Report an outbreak with your local authority to enable a coordinated local outbreak management response. You can find privacy information about the data your local authority collects and uses to prevent and control the spread of acute respiratory infections on its website.
How long we keep your information
We will only keep your personal information for as long as we need it to protect public health or as otherwise required by law.
Most of the time, we will keep your information in accordance with the time periods specified in the Records Management Code of Practice for Health and Social Care 2021 (opens in new tab). For example, the Code sets out an 8-year retention period for general medical records.
As one of our purposes for collecting personal information is to recognise trends, we may need to keep your information for longer.
The personal information used by Report an outbreak is kept for 20 years.
The information needs to be kept for this long so we can monitor outbreak reporting and control measures over a sufficient time period.
Your rights over your information
Under data protection law, you have a number of rights over your personal information. You have the right to:
- ask for a copy of any information we hold about you
- ask for any information we hold about you that you think is inaccurate to be changed
- ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate
- object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case
- delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case
- ask us not to use your information to make automated decisions about you without the involvement of one of our staff
You can exercise any of these rights by contacting UKHSA at:
UKHSA
5th Floor, 10 South Colonnade
London
E14 4PU
United Kingdom
Email: InformationRights@UKHSA.gov.uk
You will be asked to provide proof of your identity so that we can be sure we only provide you with your information.
Our legal basis to use your information
The law on protecting personal information, known as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), allows UKHSA to use the personal information collected by Report an outbreak.
The sections of the UK GDPR and the DPA that apply where we use personal information for Report an outbreak are:
- UK GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’
- UK GDPR Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health’
- Data Protection Act 2018 Schedule 1 Part 1 (3) ‘public health’
How to find out more or raise a concern
If you would like to find out more about Report an outbreak, you can contact us at enquiries@ukhsa.gov.uk.
If you have any concerns about how personal information is used and protected by UKHSA, you can contact the Department of Health and Social Care’s Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU
You also have the right to contact the Information Commissioner’s Office (opens in new tab) if you have any concerns about how Public Health England uses and protects any personal information it holds about you. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at ico.org.uk (opens in new tab) or by writing to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
About this privacy information
The personal information we collect and use may change so we may need to revise this notice. If we do, the publication date will change.
Published April 2025.
For more information, see the UKHSA privacy notice (opens in new tab)