Dental and Orthodontic Activity Dataset: Transparency Notice

This transparency notice explains for the Dental and Orthodontic Activity Dataset:

• why we collect information about you (we call this 'personal data')
• what we do with it, including who we share it with (we call this 'processing')
• how long we keep it for and where we store it
• our legal basis for using it
• what your data protection rights are

To read more about how NHS England uses personal data to improve health and care, see our privacy notice and Keeping data safe and benefitting the public.

Integrated care boards (ICBs) are NHS organisations responsible for planning and arranging health services in your local area, including dental and orthodontic services. This is called 'commissioning'. For more information see the NHS England Dental Commissioning and Policy webpage.

NHS England is responsible for making sure that the health services which ICBs commission are safe, effective, delivering value for money and are reducing health inequalities.

To do this, NHS England collects and analyses data about the care given to patients when they access NHS dental and orthodontic services, such as the type of dental treatment you received. This collection of data is called the Dental and Orthodontic Activity Dataset.

The Dental and Orthodontic Activity Dataset contains your:

• demographic information – such as your NHS number, date of birth, gender, home address including postcode and ethnicity
• health information – a summary of your dental care, such as the number of fillings you received

To protect your privacy, before the data is used it is transformed in such a way that removes or changes your personal information so that we cannot identify you as an individual without additional information. This additional information is held separately and securely. We call this process 'pseudonymisation' and data which is transformed in this way is called 'pseudonymised'.

NHS England will collect the data from the NHS Business Services Authority (NHS BSA).

We analyse your pseudonymised data to understand if dental practices are delivering the services as they should be. For example we will monitor:

• the treatment provided
• patient recall
• urgent care services
• the equality of the care provided by different dental providers

We will also look to see if different dental practices in different ICBs are providing a service of the same quality.

We also analyse your pseudonymised data to:

• understand the impact these services have on the wider NHS
• understand how patients use different parts of the NHS for their care, and how their health is affected by this - this will help us to improve the quality and safety of services and reduce differences in health between different groups of people
• identify potential issues with data quality, fraudulent activity or patient safety issues
• help us design healthcare that the people using it need and that this care is delivered by different organisation working well together
• assist NHS England to work closely with ICBs and support them to make sure dentists are delivering high quality care within their region
• check how ICBs are doing compared to other ICBs
• make decisions based on knowledge of how services are performing
• reduce waste

We will also link Dental and Orthodontic Activity Data to other datasets we hold to help us better understand how these services are helping patients and the wider NHS. For example, by linking to data about 111 referrals we can understand how many patients who call 111 for dental reasons are then able to make a dental appointment.

Data protection law requires NHS England to have a legal basis before we can process your personal data.

Our legal basis is:

Legal obligation - Article 6(1)(c) of UK GDPR. This is because the Secretary of State for Health and Social Care has issued us with a Direction to collect this dataset. This Direction is called the Delegation of NHS England Direct Commissioning Functions - Evaluation and Monitoring of Services Directions 2026 (Directions).

Substantial public interest - Article 9(2)(g) of UK GDPR, supplemented by Schedule 1, Part 2, Paragraph 6 'statutory etc and government purposes' of the DPA 2018 in order to comply with the above Directions.

Under data protection law, NHS England is a ‘joint controller’ with the Department of Health and Social Care. This means that we have jointly decided what personal data to collect and how it will be processed in accordance with the above Directions.

We share pseudonymised data with:

ICBs: to help ICBs to perform their delegated functions relating to the commissioning of dental and orthodontic services. Each ICB will be able to use data for the dental and orthodontic practices they hold a contract with. Also, where potential patient safety, or other issues are identified for dental providers or dentists, we will share the list of dental providers or dentists and the issues identified (including transaction ID) with the relevant ICB so that they can take the correct steps.

NHS BSA: Where potential issues relating to data quality or fraud are identified for dental providers or dentists, we will share the list of dental providers or dentists and the issues identified with NHS BSA to resolve the data quality or claiming pattern issues and to allow NHS BSA to perform their statutory functions as set out in The Functions of the National Health Service Commissioning Board and the NHS Business Services Authority (Awdurdod Gwasanaethau Busnes y GIG) (Primary Dental Services) (England) Regulations 2013.

Data Access Request Service

Data from this collection may be shared with organisations for planning, commissioning and research purposes where there is a benefit to health and social care. It may also be shared with organisations where it is necessary for them to meet their statutory responsibilities.

Organisations will need to apply and gain approval through our Data Access Request Service (DARS), and if approved, they must sign a Data Sharing Framework Contract and a Data Sharing Agreement.

Each application is assessed very carefully to make sure that: 

• the applicant organisation has a legal basis to access the data and NHS England has a legal basis to share the data
• the applicant organisation will use the data only for the reasons they have agreed with NHS England 
• only the minimum amount of personal data is shared in accordance with data protection principles and the National Data Guardian’s Caldicott Principles - data which identifies an individual (identifiable patient data) is only shared where it is absolutely necessary and where there is a legal basis to do so
• the applicant organisation will handle and store the data securely

Where a DARS application is approved, data may be shared for analysis through the NHS England Secure Data Environments, in line with NHS policy on Secure Data Environments.

We publish the details of approved DARS applications on our website. See the Data Uses Register.

Processors

We use Microsoft Azure and Amazon Web services (AWS) to provide secure cloud hosting services under a contract known as a ‘Data Processing Agreement’. They can only use, store and keep the data as set out in our instructions and cannot use the data for any other purposes.

Your data will be held for as long as we have a legal basis and purpose to retain your data under the above Directions.

We keep your data in accordance with the Records Management Code of Practice 2021.

We securely store your data on servers in the United Kingdom (UK).

Under data protection law, you have the following rights over your data for this data collection:

Your right to be informed – You have the right to be told how and why we are using your personal data. We have published this transparency notice to provide you with this information.

Your right to get copies of your data – You have the right to ask us for copies of your personal data (right of access). For more information, see how to make a subject access request.

Your right to get your data corrected – You have the right to ask us to correct (rectify) your personal data if you think it is inaccurate or incomplete.

Your right to limit how we use your data – You have the right to ask us to limit the way we use your personal data (restrict processing) in certain circumstances.

To make a rights request, email us at [email protected].

When NHS England collects the Dental and Orthodontic Activity from NHS BSA

If you have registered a National Data Opt-Out, NHS England can still collect your data under the Delegation of NHS England Direct Commissioning Functions - Evaluation and Monitoring of Services Directions 2026. This is because the National Data Opt-Out does not apply where NHS England has a legal obligation to collect the data (see section 6.4 of the National Data Opt-Out Operational Policy Guidance for more information).

When NHS England shares Dental and Orthodontic Activity data

For any data we share with other organisations through our Data Access Request Service, we will apply the national data opt-out in line with the National Data Opt-Out Operational Policy Guidance.

You can find out more about and register a national data opt-out, or change your choice, on the NHS website - Choose if data from your health records is shared for research and planning.

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England uses your data, contact our Data Protection Officer at [email protected].

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website at Make a complaint - ICO.

We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.