Guidance

National Child Measurement Programme: privacy notice

Published 17 July 2025

Applies to England

Introduction

The National Child Measurement Programme (NCMP) is a statutory public health surveillance programme in England which collects the height and weight of primary school children in reception (aged 4 to 5) and in year 6 (aged 10 to 11).

Local authorities have a statutory function, set out in law, to:

• complete children’s height and weight measurements
• return relevant data to NHS England

Local authorities do this by following the NCMP operational guidance from the Department of Health and Social Care (DHSC).

Who collects and processes your child’s data

Your local authority is responsible for collecting your child’s height and weight measurements at school. They are responsible for making decisions on how the measurements are collected and making sure it is protected. Your local authority may contract local NCMP service providers to do the measurements. This might be through the school nursing team or a local healthcare provider.

Your local authority or the team collecting the data on their behalf will send all the information collected about your child to the NCMP IT system which is provided by NHS England. School nursing teams may enter the data into a local child health information system before uploading to the NCMP IT system.

NHS England is responsible for collecting data and information about health and care so that it can be used to monitor and improve the care provided to people across England.

NHS England also securely shares your child’s data which has been made anonymous with DHSC for analysis.

Data controller

At national level

DHSC is a data controller for your child’s data in the NCMP at the national level. As a data controller, we are responsible for the information we hold about your child, which means that we:

• have a responsibility to protect your child’s privacy
• decide how to use the information we hold about your child
• are responsible for keeping you informed about changes to how we collect or use your child’s data

NHS England is also a data controller. DHSC and NHS England are jointly responsible for the data held at a national level.

At local level

Your local authority is the data controller at the local level.

What information we collect

Your child’s personal data

In the NCMP your local authority, or the team collecting data on their behalf, collects data on your child’s:

• height
• weight
• sex
• date of birth
• date of measurement

These are used to calculate your child’s weight or body mass index (BMI) category.

Your local authority, or the team collecting data on their behalf, also collects your child’s:

• name
• date of birth
• NHS number

These are used to link your child’s measurements in reception and year 6.

Your local authority, or the team collecting data on their behalf, also collects your child’s:

• ethnicity
• address

These are used to help understand some of the reasons for the differences and changes in child growth and weight across England.

Your personal data

Your local authority, or the team collecting data on their behalf, also collects your contact details, specifically your:

• address
• email
• telephone number

If your local authority feeds back measurement information to parents, they may need your address to send you your child’s feedback letter. The feedback letter may include your child’s measurements along with information about healthy eating, being active and related activities available in your area.

Your local authority might need your email address and phone number because they may:

• contact you by email or phone to discuss your child’s feedback
• send you your child’s feedback letter by email
• offer you further support following your child’s height and weight measurement

What we do with your child’s data

Local authorities and the NHS use the information from the programme to plan the provision of health and leisure services for families to promote healthier growth in children.

Both NHS England and DHSC will use the information from the NCMP to better understand numbers and trends in child weight and BMI. This helps to plan services to support healthy lifestyles in your area. NHS England or DHSC will never publish any information that identifies your child.

DHSC uses the data to produce National Child Measurement Programme statistics reports showing trends at national and local level.

We may also link other DHSC data sets with data sets held by NHS England and the Department for Education to your child’s data to allow information from health and education records to be added, where it’s lawful to do so. These other data sets may include your child’s health data relating to:

• their birth
• hospital care (including time in hospital, out-patient appointments and diagnosis of medical conditions)
• mental health
• social care
• primary care (including all healthcare outside of hospital, such as GP and dental appointments)
• public health (including data about preventing ill health, such as immunisation records)
• records for when and the reason why people have died
• medical conditions, such as cancer and diabetes
• health, lifestyle and wellbeing surveys that your child has participated in

Linking the data helps us to understand:

• how and why the weight and growth of children is changing
• how that affects children’s health and education
• how the care children receive can be improved

Why we collect your child’s data

All the data collected is used for planning and research to improve health, care and services.

Legal basis for processing your child’s data

Data protection legislation requires us to have a valid legal reason to process and use personal data about your child. This is often called a ‘legal basis’.

UK General Data Protection Regulation (UK GDPR) requires us to be clear with you about the legal basis we rely on to process information about your child. Under Articles 6 and 9 of the UK GDPR, the legal bases we rely on for processing your child’s data are that:

• we have a legal obligation
• it’s necessary to perform a task or function in the public interest or for our official functions and the task or function has a clear basis in law
• it’s necessary for the provision of health or social care
• it’s necessary for reasons of public interest in the area of public health
• it’s necessary for statistical purposes

These legal bases only apply if we take suitable and specific measures to protect your rights, and we only use your information for the purposes we describe in the section above on what we do with your information.

Parental consent is not the legal basis for processing NCMP data.

Who we share your child’s data with

At national level

At national level, NHS England securely provides DHSC with a copy of the national data set, which has been made anonymous in line with the Information Commissioner’s Office (ICO) code of practice, Anonymisation: how do we ensure anonymisation is effective? This protects the confidentiality of the children. DHSC analyses the NCMP data set and produces reports and resources to help local authorities use the NCMP data in their area.

NHS England may share anonymised information from the NCMP with other organisations, such as universities. This is to help improve health, care and services through research and planning. This information cannot be used to identify your child. NHS England only ever shares information for research through formal assurance and approval processes, and will ask advice from experts if necessary.

Researchers can apply to NHS England through the Data Access Request Service to access extracts of NCMP data. They can only access parts of the data that are allowed to be shared for research purposes. No child’s name, date of birth or address details will be shared, since these are not in the national data sets held by NHS England and DHSC. If the application is approved, NHS England provides the  NCMP data under a data sharing contract and agreement to control the small risk of children being identified. NHS England considers any requests for data extracts on a case-by-case basis.

At local level

At local level, the legislation also allows NCMP data to be:

• provided to children’s parents by local authorities – they may give parents their child’s data, along with advice about children’s growth and weight, and information about advice and support available to them to help them improve their child’s health
• disclosed by the local authority to a health and care professional who can give advice and support to parents to help them improve their child’s health, and offer any related treatment to the child

Where NCMP data is disclosed to a health and care professional, your local authority must have a local data sharing agreement in place between the local authority and the organisations the data is being shared with, to ensure it is shared securely.  

Local authorities may also securely provide NCMP data to other people or organisations, such as researchers, in a form in which no child can be identified.

Contact your local authority for information about how they collect, use and who they share your child’s data with.

How long we keep your child’s data

DHSC will keep personal data either for as long as it is needed for the purposes described in this privacy notice, or the period required by law or other regulations, whichever is longer.

NHS England holds the NCMP data for 20 years before reviewing whether to retain it for longer, as outlined in their records management code of practice. This is because the data has historic and trend analysis value.

You can contact your local authority or their NCMP provider if you want to see their data retention and disposal policy.

How we keep your child’s data secure

You can find out how we keep and secure your child’s data in the ‘How we protect your personal data at DHSC’ section of the DHSC Personal information charter.

You can find out how NHS England keeps your child’s data secure at their How we look after your health and care information web page.

Local authorities ensure that they have appropriate controls in place locally to securely store the NCMP data, as well as manage who can access it and for what purposes.

Your child’s measurement information is treated confidentially and held securely. The information collected from all schools in your local authority will be gathered together and held securely by your local authority. They will not give individual measurements to school staff or other children. Your local authority may store your child’s data as part of the local child health record on the NHS’s child health information database and may share it with the child’s GP.

You can contact your local authority or NCMP provider to find out about how they hold and secure your child’s data.

Your rights as a parent

By law, you have a number of rights, and processing your child’s data does not take away or reduce these rights under the UK GDPR and the UK Data Protection Act 2018 applies.

You have the right to:

• ask for and receive copies of information about your child
• get information about your child corrected if you think it’s inaccurate
• limit how your child’s data is used, for example you can ask for it to be restricted if you think it’s inaccurate
• object to your child’s data being used
• get your child’s data deleted

If you do not want your child’s height and weight to be measured, you have the right to withdraw your child. You must inform your local authority or NCMP provider before measurement day. Children will not be made to take part on the day if they do not want to.    

You can only get your child’s data corrected or deleted from the national data set held by NHS England if you request this from your local authority before the end of the collection year, which is at the beginning of August every year.

For data held at local level, contact your local authority for information about your right to get your child’s data corrected or deleted.

The right to get data deleted is not an absolute right, and we may need to continue to use your child’s data. We will let you know if this is the case.

There are also some circumstances in which we cannot delete your child’s data. For example, if it has been made anonymous and we cannot tell which data relates to them.

If you want to object to your child’s data being used in the national data set held by NHS England, you can only do this if you submit a request to your local authority before the end of the collection year. However, this is also not an absolute right, and we may need to continue to use your child’s data. We will let you know if this is the case.

For data held at local level, contact your local authority for information about your right to object to your child’s data being used.

Contact us or make a complaint

We will always try to respond to concerns or queries that you have about your child’s data.

If you are unhappy about how we use your child’s data as part of this programme, or if you want to complain about how we use your child’s data, you should email data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

If you are still not satisfied, you can complain to the ICO. You can find out how to contact them at the ICO website.  

Their postal address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Changes to this policy

This privacy notice is kept under regular review and will be updated if necessary. All updated versions will be marked by a change note on this privacy notice’s publication page.