Personal information and data protection

National data opt-out programme

The Council collects personal data in order to deliver specific services to its service users. For example, adult care may collect information such as name, DOB & address or health information in order to complete an assessment to provide support to the service user. The National Data opt-out programme enables service users to opt out of their data being used for anything other than providing care or a direct service to them.

There are now rules in place concerning secondary use of health and social care data. This is when personal data is used for purposes not involving individual care/delivery of services to service users, for example for research and planning purposes. All health and care organisations are now required to respect these decisions and comply with the National Data Opt Out.

The opt-out applies to confidential patient information (CPI) that originates within the health and adult social care system.

Service users can update their preferences at any time and the opt-out continues to apply after an individual has died. If a service user has opted out, you cannot use their data for any purpose other than direct service delivery. There are a limited number of exceptions to this.

The rules relating to data protection, human rights and confidentiality still need to be applied.


The national data opt-out has been implemented following recommendations by the National Data Guardian to ensure that service users are clear when health and care information about them will be used and in what circumstances they can opt out.

In focus groups of members of the public, people were comfortable with data being shared with care professionals for their care, but not anywhere else within the local authority

People must feel able to discuss sensitive matters with a doctor, nurse or social worker without fear that their information may be improperly disclosed.

There should be ‘no surprises’ for the individual about who has had access to information about them.

People this affects

Anyone whose confidential patient information is collected, used and shared.

You need to have an NHS Number to apply an opt-out.

The Council cannot apply an opt-out for an individual.

Individuals should contact the NHS if they wish to have the opt-out applied to their data


The opt-out only applies to confidential patient information (CPI) - data that includes both:

  • information that identifies or could be used to identify the service user
  • information about their physical or mental health, care or treatment

And is given in circumstances where the individual is owed an obligation of confidence.

Care or a direct service

Service user data is recorded so that it can be used by health and care professionals to make diagnose and make decisions about care. This is referred to as 'for individual care and treatment', or 'direct care'. This could include:

  • sharing information between social care and health to provide a service
  • local quality audits when undertaken by someone involved in the care

How it works

The national data opt-out is based on a single question that covers all uses of data beyond individual care, namely;

"Your confidential patient information can be used for improving health, care and services, including:

  • planning to improve health and care services
  • research to find a cure for serious illnesses

Your decision will not affect your individual care and you can change your mind anytime you like.

I allow my confidential patient information to be used for research and planning"

An individual can use the service to ‘opt-out’ of the secondary use of their data. This means that the Council would need to check with NHS Digital as to whether an individual has opted out before sharing or using their confidential personal information.

When the opt-out is applied, the entire record (or records) associated with that individual must be fully removed from the data being disclosed.

The opt-out applies regardless of the format of the data and this includes electronic and paper records.

This would include information that had been pseudonymised.