East of England ICB Transition Employee Privacy Notice – October 2025

This is a separate privacy notice to cover partnership working between the EoE ICBs.  Please visit NHS England website for more information.

Whilst the ICBs begin to work together it will be necessary for ICBs to share employment data as described in this notice across the ICBs until the proposed changes are formally agreed from  1^st April 2026.

This notice explains how the ICBs collect, uses and shares personal data relating to prospective, current and former employees, workers, self-employed contractors and consultants, and voluntary workers, and your rights in relation to the processing of your personal data.

In this notice:

• personal data means any data which can identify you directly or indirectly (whether itself or when combined with other data), regardless of the format or media on which the data are stored. This includes data that can identify you when combined with other data that is held separately (pseudonymised data) but does not include data that has been manipulated so that you can no longer be identified from it (anonymous data).  Examples, name, address, date of birth.
• Special Categories of personal data relates to information that is sensitive in nature and could cause harm to you or your reputation if processed inappropriately.  Examples, health related information, criminal convictions, financial information.
• processing means any activity relating to your personal data including collection, use, alteration, storage, disclosure and destruction.

Types of personal data processed

Depending on your role, this notice sets out the types of personal data that the ICB may collect and process about you, including “special categories of personal data” which are particularly sensitive and require us to take additional steps to ensure their security and confidentiality.

We will collect and record information such as:

• your name, address and contact details, including email address and telephone number, date of birth and gender;
• the terms and conditions of your employment;
• details of your qualifications, skills, experience and employment history, including start and end dates, with previous employers and with the organisation;
• information about your remuneration, including entitlement to benefits such as pensions or insurance cover;
• details of your bank account and national insurance number;
• information about your marital status, next of kin, dependants and emergency contacts;
• information about your nationality and entitlement to work in the UK;
• information about your criminal record;
• diversity data such as information about your sexual orientation, religious beliefs and/or disability
• details of your schedule (days of work and working hours) and attendance at work;
• details of periods of leave taken by you, including holiday, sickness absence, family leave and sabbaticals, and the reasons for the leave;
• details of any disciplinary or grievance procedures in which you have been involved, including any warnings issued to you and related correspondence;
• assessments of your performance, including appraisals, performance reviews and ratings, training you have participated in, performance improvement plans and related correspondence;
• information about medical or health conditions, including whether or not you have a disability for which the organisation needs to make reasonable adjustments;
• details of trade union membership; and
• equal opportunities monitoring information, including information about your ethnic origin, sexual orientation, health and religion or belief.

Your personal information is usually obtained from you directly or from a predecessor organisation under TUPE arrangements in the first instance.   We may also obtain personal information about you from your manager, referees, relevant Regulatory Bodies, Pensions Service, DBS and Occupational Health.

Lawful grounds for processing your personal data

We will only use your personal data when we are permitted to do so by law. Most commonly, we will use your personal data:

• with your consent we will process information about some of your protected characteristics. This is to help us monitor our diversity. You can choose to provide us with this information, but you are not obligated to do so (GDPR Article 6 (1)(a))
• to perform a contract the ICB has entered into with you, or to take steps before entering into a contract with you at your request (for example, your employment contract or contract for services) (GDPR Article 6 (1)(b))
• to comply with the ICB’s legal obligations (for example, complying with employment and tax, immigration, health and safety and safeguarding laws, preventing and detecting crime, assisting the police and other authorities with their investigations) (GDPR Article 6 (1)(c))
• where necessary for our legitimate interests or those of a third party provided your interests and rights do not override those interests (for example, evaluating the suitability of a candidate for a role or defending employment claims brought by you) (GDPR Article 6 (1)(f))
• to protect your vital interests or those of another person (for example, where we know or have reason to believe that you or another person may suffer harm) (GDPR Article 6 (1)(d))
• to carry out the obligations and specific rights of the ICB or employee in the field of employment and social security and social protection (GDPR Article 9 (2)(b))
• for establishment, exercise and defence of legal claims (GDPR Article 9 (2)(f))
• for preventative and occupational medication (for example, assessment of the working capacity of an employee) (GDPR Article 9 (2)(h))

In circumstances where you have a genuine choice as to whether we should process your personal data, we will ask you for your consent. The method used to obtain your consent will depend on the scope and context of the processing that we propose.

In relation to special categories of personal data, we may request your explicit consent unless a condition applies which allows us to process such personal data without doing so.

Sharing your personal data

Where the ICB has lawful grounds for doing so, the ICB may share your personal data with third parties in connection with your employment contract, please see the MSE Employee Privacy Notice for further details.

We may also share anonymised information that could contain parts of your employment record. We can only do this if the information cannot be linked back to you.

How long the ICB will retain your personal data

The ICB must only to retain your personal data for as long as necessary to fulfil the purposes for which it was collected and to satisfy any legal, regulatory, accounting or reporting requirements.

We adhere to the NHS Records Management Code of Practice 2021 which sets out what people working with or in NHS organisations in England need to do to manage records correctly.

As per the retention schedule linked to above, all relevant information in relation to your employment or engagement will be held by Human Resources and retained for six years after you have left the ICB or your engagement has ceased, after which time it will be summarised, the main file destroyed and then held until your 75th birthday.

Your rights

You have rights in relation to the processing of your personal data by the ICB:

• Access: You have the right to request access to and be provided with a copy of the personal data held about you together with certain information about the processing of such personal data to check that the ICB is processing it lawfully and fairly.
• Correction: You have the right to request correction of any inaccurate or incomplete personal data held about you.
• Deletion: You have the right to request erasure of any personal data held about you where there is no good reason for the ICB to continue processing it or where you have exercised your right to object to the processing of your personal data.
• Restriction: You have the right to request restriction of how the ICB processes your personal data; for example, to confirm its accuracy or the ICB’s reasons for holding it or as an alternative to its erasure.
• Objection: You have the right to object to the ICB’s processing of any personal data which is based on the legitimate interests of the ICB or those of a third party based on your particular circumstances.
• Portability: You have the right to receive or request that the ICB transfers a copy of your personal data in an electronic format where the basis of the ICB processing such personal data is your consent or the performance of a contract, and the information is processed by automated means.

To exercise any of these rights you must contact the ICB’s Data Protection Officer (DPO) in the first instance, by emailing your ICB Data Protection Officer (DPO) Contact details below. The ICB may be entitled to refuse any request in certain circumstances and where this is the case, you will be notified accordingly.

Where the lawful ground relied upon by the ICB to process any of your personal data is your consent, you have the right to withdraw such consent at any time without having to give any reason. However, if you do so, the ICB may not be able to provide some or all of its services to you or the provision of those services may be affected.

Your responsibilities

You must ensure that any personal data collected and processed by you in the course of performing your duties and obligations is held in accordance with the ICB’s suite of Information Governance policies.

Members of staff can access, amend or notify the ICB of any changes to their contact details via ESR. It is important the ICB has an accurate record of staff details in case there is a need to contact staff in emergency circumstances.

Questions / Concerns

If you have any questions or concerns about the processing detailed in this notice, please contact your local Data Protection Officer (DPO).