Corporate report

OPSS Privacy Notice: Emergency Care Dataset

Published 5 February 2026

This Privacy Notice sets out how we process personal data in relation to the Emergency Care Dataset (“Dataset”) we receive from NHS England, and the rights of the individuals whose personal data we use. 

This Privacy Notice contains the information we are required to provide individuals to comply with our obligations under Article 14 of the UK General Data Protection Regulation (“UK GDPR”).   

1. Who we are

The Office for Product Safety and Standards (“OPSS”, “we”, “our” and “us”) is a departmental office within the Department for Business and Trade (“DBT”), and it is the UK’s national product regulator.  Our primary purpose is to protect people and places from product-related harm, enabling trade and growth by ensuring consumers and businesses can buy and sell products with confidence.    

DBT is the Data Controller of the personal data we collect. This means DBT has overall responsibility for ensuring our use of personal data is lawful, and we have secure systems in place to protect it.  For further information, you can contact the DBT’s Data Protection Officer using the details set out at the end of this Privacy Notice.   

2. Scope

This Privacy Notice applies to our use of the Dataset. This Privacy Notice is supplemented by our main privacy notice which provides further information on how DBT processes personal data.

3. Personal data we collect

We receive the Dataset from NHS England. We do not collect information directly from the patients the Dataset concerns. The Dataset is comprised of information about individuals who attend urgent and emergency care in England, including:

• age
• gender
• ethnicity
• socio-economic indicators
• injury details (intent, type, mechanism, place, circumstances)
• clinical diagnosis and treatment information
• admission and discharge outcomes
• organisation providing care

NHS England pseudonymises the Dataset. This means it does not contain the names of patients or other personal identifiers such as NHS numbers. Instead, patients are assigned randomised 15-character reference IDs. Although we do not receive personal identifiers, in some instances it might be possible to determine the identity of a patient from the combination of information we do receive. It’s for this reason that we handle the Dataset on the precautionary basis that it may contain personal data.

4. Why we process the Dataset

As mentioned, OPSS’ primary purpose is to protect people and places from product-related harm. In order to do so, it’s important we have access to information about injuries involving products. The Dataset contains this type of information.

OPSS uses the Dataset to investigate and understand injuries involving products. These may include, for example, injuries linked to washing machines, fireworks and button batteries. Through our processing, we are able to:

• quantify and track injuries over time
• identify emerging trends in injury
• gain insight into underlying patients’ characteristics and behaviours associated with the injury

5. Legal bases for processing personal data

The table below sets out the primary legal bases we rely on for processing the Dataset.

Description	Legal basis
All personal data included in the Dataset.	Article 6(1)(e) of the UK GDPR, that processing is necessary for a task carried out in the public interest or in the exercise of official authority.
Personal data which is the subject of a request under the Freedom of Information Act 2000, or which we are otherwise required to disclose in the context of legal proceedings.	Article 6(1)(c) of the UK GDPR, that processing is necessary to comply with a legal obligation to which we are subject.
All personal data included in the Dataset to the extent it is comprised of “data revealing racial or ethnic origin” and qualifies as special category personal data for the purposes of Article 9 of the UK GDPR.	Article 9(2)(g) of the UK GDPR and para 6, Part 2, Sch 1 of the Data Protection Act 2018, that processing is necessary for reasons of substantial public interest, and for the exercise of our functions.
All personal data included in the Dataset to the extent it is comprised of “data concerning health”, and qualifies as special category personal data for the purposes of Article 9 of the UK GDPR.	Article 9(2)(g) of the UK GDPR and para 6, Part 2, Sch 1 of the Data Protection Act 2018, that processing is necessary for reasons of substantial public interest, and for the exercise of our functions.

6. How we process the Dataset

We securely store the Dataset within DBT’s cloud-based analytical environment. This is hosted by Amazon Web Services in the UK, and is managed by OPSS’ Analysis and Research Team (“Team”), which carries out various analyses. By way of example, this involves the Team:

• reviewing the Dataset
• applying filters to derive insights
• producing anonymised, aggregated statistics

From time-to-time, OPSS may also use the Dataset for research purposes to inform the development of policy or the exercise of its regulatory functions. 

7. Information sharing

As a public body, OPSS is subject to the Freedom of Information Act 2000 and may receive requests for information relating to the Dataset. OPSS handles any such requests in line with its statutory obligations. There may also be occasions where we are required to disclose information to a court, tribunal or party because we are ordered to do so or it is necessary to exercise, establish or defend a legal claim.

We do not share raw data from the Dataset from third parties. OPSS only shares anonymised, aggregated statistics which do not contain personal data. We may share this with parties such as:

• other government departments, public authorities, law enforcement agencies and regulators
• third parties where we consider it necessary or helpful in order to further our objectives

8. How long we hold your data for

Consistent with the terms of our arrangement with NHS England, we will retain the Dataset until 27 June 2027, unless we agree to extend the duration of our arrangement.  If so, we will review our ongoing need to retain your personal data in line with our obligations under UK data protection legislation and will not retain it for any longer than is necessary to fulfil the purposes we collected it for.

9. Your rights

You have a number of rights available to you under UK data protection legislation, including:

• the right to request copies of the personal data we hold about you
• the right to request that we rectify information about you which you think is inaccurate or incomplete
• the right to request that we restrict your personal data from further processing (in certain circumstances)
• the right to object to the processing of your personal data (in certain circumstances)
• the right to data portability (in certain circumstances)
• the right to request that we erase your personal data (in certain circumstances)
• the right not to be subject to a decision based on solely automated data processing

For this Dataset, some of these rights may be limited because we are not able to reidentify individuals from the pseudonymised data we hold, so we would be unable for example to provide a copy of the personal data we hold about you or to erase your personal data.

Further, on the basis that we are not able to reidentify individuals from the pseudonymised data we hold, it is not possible to provide privacy information directly to individuals, and so we make the required information available through this Privacy Notice in accordance with Article 14(5)(b) of the UK GDPR.

10. Further information

For further information about how we process personal data, or to make a complaint about how your personal data has been used, please contact DBT’s Data Protection Officer: data.protection@businessandtrade.gov.uk.

Please also be advised that you have the right to complain to the Information Commissioner’s Office (“ICO”) if you consider we have breached your information rights. The ICO’s contact details are as follows:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

W: https://ico.org.uk/

Tel: 0303 123 1113