Privacy notice

This privacy notice is intended to provide transparency regarding what personal data the Scotland Deanery (NHS Education for Scotland) will collect about you, how it will be processed and stored, how long it will be retained and who will have access to your data.

The Scotland Deanery (NES) is the data controller in respect of the personal data it holds concerning trainees in postgraduate training programmes.  Personal data is information from which an individual can be identified either directly or indirectly when the information is read in conjunction with other data that a data controller holds.  From 25 May 2018, the UK Data Protection Act 1998 will be replaced by the General Data Protection Regulation. The Scotland Deanery (NES) will be subject to the General Data Protection Regulation from this date.

As a trainee, please be aware that this privacy notice applies to the processing of all of your personal data by the Scotland Deanery (NES) in relation to, or arising from, your training.

Why your personal data is collected

Your personal data is collected and held for the purposes of the functions of the Scotland Deanery (NES).  Those functions are set out in A Reference Guide for Postgraduate Specialty Training in the UK, also known as 'The Gold Guide'. These purposes include: -

1. To manage your training and programme – Personal data collected for this purpose will be kept in your training file, which will usually contain your recruitment data (application form, recruitment documentation and any immigration records), ARCP records, significant correspondence, and any other information pertinent to the effective management of your training and education.
2. To quality assure training programmes and ensure that standards are maintained – via local and national quality assurance teams, and methods such as the General Medical Council (GMC) national training survey.
3. To identify workforce planning targets – Your data will be used to determine outputs from programmes and to inform the number of trainees required for specialties in the future.
4. To maintain patient safety through the management of performance concerns – Your personal data may be shared with the GMC should there be significant concerns regarding your fitness to practise.
5. To comply with legal and regulatory responsibilities including revalidation.
6. To contact you about training opportunities, events, surveys and information that may be of interest to you.

The functions of the Scotland Deanery (NES) are carried out in the public interest. The processing of trainees’ personal data is necessary for the purposes of those functions.

How your personal data is collected

Personal data is collected via the recruitment process, your Annual Review of Competence Progression (ARCP) and when submitting information for revalidation purposes.  Personal data may also be obtained from Local Education Providers or employing organisations and other relevant organisations to fulfil the functions of the Scotland Deanery (NES) in relation to doctors in training.

If you spend time in countries outside the European Economic Area as part of your training, we may share relevant personal data as necessary with placement providers, regulators and public authorities in those countries for purposes relevant to your training and professional practice. In sharing information with organisations in these countries we will comply with the requirements of the General Data Protection Regulation, including having written agreements in place.

How your personal data is kept secure

Access to your personal data is restricted to the authorised team within the Scotland Deanery (NES) that manages your training. Access is also granted on a limited basis to recipients such as Training Programme Directors and lay representatives but only where necessary for a specified and legitimate purpose.

Your personal data will be retained for six years after you have left your training programme, at which point your personal data will be confidentially and securely destroyed.

How and why your personal data may be shared

The Scotland Deanery (NES) will only transfer your personal data to third parties using secure channels and where it is needed to manage your training, for example when rotating through placements or notifying Medical Royal Colleges/Faculties of ARCP outcomes.

The Scotland Deanery (NES) will not transfer your data unless it is satisfied of the following matters:

1. That there is a fair and lawful basis to share your personal data with the third party.
2. The data will be handled by the third party in accordance with the law on data protection.

Where the data is used for analysis and publication by a recipient or third party, any publication will be on an anonymous and aggregated basis, and will not make it possible to identify any individual. This will mean that the data ceases to become personal data.

Third parties may include the following non-exhaustive list: the UK health departments, Colleges/Faculties, other deaneries, the GMC, NHS Trusts/Health Boards/Health and Social Care Trusts and approved academic researchers.

Your rights and responsibilities

It is important that you work with us to ensure that the information we hold about you is accurate and up to date so please inform the Scotland Deanery (NES) immediately if any of your personal data needs to be updated or corrected.

All communications from the Scotland Deanery (NES) will normally be by email. It is therefore essential for you to maintain an effective and secure email address or you may not receive information about your posts and assessments or other important news and information about your training.  Please ensure that the email address we hold for you on Turas is accurate and up to date.

You have the right to access the information which the Scotland Deanery (NES) holds about you, subject to any exemptions using a Subject Access Request.  Requests must be made in writing and you will need to provide: 

• Adequate information [for example full name, address, date of birth, staff number etc] so that your identity can be verified and your personal data located. 
• An indication of what information you are requesting to enable us to locate this in an efficient manner. We will aim to comply with requests for access to personal data as quickly as possible.  We will ensure that we deal with requests within 30 days of receipt unless there is a reason for delay that is justifiable. 
• You should send your request to the NES Information Governance Team. 

In certain limited circumstances, you have a right to object to processing that is likely to cause you damage or distress, or to any decisions made by automated means that significantly affect you.

You also have a right to have inaccurate personal data rectified, blocked, erased or destroyed.

If you wish to exercise any of these rights or have any concerns in relation to how your personal data is processed, please contact the NES Information Governance Team.

Should you wish to learn further information about data protection, please visit the website of the Information Commissioner's Office (ICO) website.

This page was last updated on: 03.04.2024 at 15.37