Skip to main content
Guidance

Reciprocal healthcare privacy notice

Sets out how DHSC and NHSBSA collect and use personal information as part of the process of providing reciprocal healthcare.

Updates to this page

From:
Department of Health and Social Care and NHS Business Services Authority
Published:
18 February 2020
Last updated:
14 October 2026
Show all updates

  1. Joint privacy notice updated to reflect that personal data will be anonymised to maintain compliance with UK GDPR.

  2. Updated the text of 'Joint privacy notice for the implementation of reciprocal healthcare arrangements', amending to: remove or change EU exit wording from before finalised agreements were in place; increase the scope of the privacy notice as it now covers non-EU countries such as Overseas Territories.

  3. Edited template to include each reciprocal healthcare arrangements with the EU, Switzerland and EFTA States.

  4. Added new attachment: 'Reciprocal healthcare joint data controller agreement: schedule 1'.

  5. First published.

Documents

Joint privacy notice for the implementation of reciprocal healthcare arrangements

HTML

Reciprocal healthcare joint data controller agreement: schedule 1

HTML

Details

The Department of Health and Social Care (DHSC) and the NHS Business Services Authority (NHSBSA) have joint responsibility for data relating to claims for financial reimbursement for reciprocal healthcare treatment.

This privacy notice describes how we collect and use personal information about you, in accordance with data protection law, including the the UK General Data Protection Regulation 2016/679 (‘the UK GDPR’) and the Data Protection Act 2018.

The joint data controller agreement sets out how DHSC and NHSBSA will process personal data as joint controllers.

Sign up for emails or print this page