National Paediatric Diabetes Audit - Privacy Notices

What data are we collecting, and why?

HQIP, the Department of Health, and Digital Health and Care Wales (DHCW) decide how we use the data we collect.  They are joint data controllers.  The RCPCH is the data processor. We collect data from paediatric diabetes units (PDUs) on the recommended health checks they are doing for the children and young people they look after, as well as the results of these health checks. We also collect data on diabetes related admissions in order to identify trends and inform strategies to reduce avoidable admissions. The full dataset can be viewed here. The data collected are held on secure servers which meets all data protection legislative requirements and are hosted within the EU. We collect data from PDUs in Wales, Jersey and England.

All hospitals in England and Wales have to take part, under the NHS standard contract, and the NHS Wales National Clinical Audit and Outcome Plan 2024-2025.  Your data is important as, without it, we would not be able to conduct this audit which would make it more difficult to make national improvements in paediatric diabetes care.

As well as collecting information from PDUs, we also invite children and young people with diabetes (and their parents/carers) to complete online surveys called Patient Reported Experience Measures (PREMs). All responses are anonymised before reporting. You can find the privacy notice for our PREMs surveys here: https://www.rcpch.ac.uk/privacy-notices/surveys

Legal basis for processing - England and Wales

Under GDPR, we need to have a legal basis for processing your personal data. This means that we need a specific reason to collect and use your data in our audit.  Because we are processing medical data, we need to get special permission from the NHS to do so.  This is called section 251 approval and allows us to collect patient identifiable data without explicit consent, as our aims are in the public interest.  This is because the audit will help to improve the standards of paediatric diabetes care. To find out more about section 251 approval, please visit the Health Research Authority website.

Processing is permitted under GDPR on the following legal bases:

Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This is justified through commissioning arrangements which link back to NHS England and the Welsh Government. (Public Task)

Article 9 (2) (i) processing is necessary for reasons of public interest in the area of public health (schedule 1(1)(3), such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy. This is justified as the NPDA aims to drive improvements in the quality and safety of care and to improve outcomes for patients. The DPA 2018 schedule 1(1)(3) ‘public health’ interest is underpinned by the Health and Social Care Act 2012 Part 1 section 2.  This places a duty on the secretary of state to improve the quality of health services. (Substantial Public Interest)

The results of the audit are published, from national, to PDU level, on our Reporting Dashboards so you can see how your PDU is doing. 

We also publish annual reports and patient and parent guides, which are publicly available on our website and via https://data.gov.uk/.

No identifiable data will ever be published.

Legal basis for processing - Jersey

In Jersey, processing is permitted under the Data Protection (Jersey) law 2018 under the following legal bases:

• Public function under the common law of duty of confidentiality  

Information we share

Where we have determined that the research project is aligns with NPDA aims, data may be shared with third parties for the purposes of service evaluation or quality improvement by external academic researchers. Data will only ever be shared in a pseudonymised format (unless the requester has their own legal basis for holding patient identifiable data) and only with the approval of HQIP. For HQIP to approve the request, the requestor must be able to demonstrate compliance with stringent data protection policies and arrangements and the aims of the research must be approved, as per the information provided in HQIP’s Understanding Health Data Access Website Personal data shall not be transferred to a country or territory outside the EEA. Pseudonymised or summary data may be shared outside of the EEA as per HQIP guidance.

The NPDA also collaborates with the National Diabetes Audit managed by NHS England to produce two audits of young adult care: Adolescent and Young Adults with Type 1 Diabetes and Young People with Type 2 Diabetes.  Annual reports are published publicly via our website and via data.gov.uk. All data is reported at the level of individual paediatric diabetes units so that no patient identifiable data will ever be published. Privacy information relating to this audit is available from NHS Digital.

Patient identifiable data collected from PDUs in England  is shared with NHS England each quarter as part of the NHS England hybrid closed loop (HCL) 5-year implementation strategy. More information about the strategy is available here. This data will allow NHS England to reimburse integrated care boards for any HCLs purchased and provided to patients within their area. This data is also used to inform the NHS England Getting It Right First Time (GIRFT) programme. 

International Transfer of Data between England and Jersey

As Jersey is outside of the UK, this is considered an international transfer under UKGDPR, so additional checks need to be undertaken to ensure that any personal data has an equivalent level of data protection in both countries. The UK is deemed adequate by the Jersey Office of the Information Commissioner, and the UK have deemed Jersey as having an adequate level of protection, so no further steps are required to ensure the transfer of your personal data between the UK and Jersey.

How long do you keep my data for?

The NPDA team at the RCPCH acts as the data processor on behalf of HQIP, who are the data controllers for the NPDA data. The RCPCH will hold the NPDA data for as long as it is contracted to deliver the NPDA. All data will be deleted or transferred back to HQIP within two weeks of the end of our contract as per HQIP’s instructions.

Opting out of audits

Opting out of audits - England and Wales

In England, the National Data Opt-Out service allows patients aged 13 or over (or those with parental responsibility for patients under 13) to opt out of their information being used for purposes beyond their direct care. The Secretary of State for Health and Social Care, having considered the advice from the Health Research Authority Confidentiality Advisory Group, has decided that the National Data Opt-Out will not be applied to the NPDA. 

This is because applying the National Opt-Out could introduce bias to the data and make it difficult to monitor care safety and quality within healthcare providers, leading to poor quality of care and health services and jeopardising patient safety.  It could also reduce the impact of the data on improving care locally and nationally. However, you can still opt out of your personal information being used for this audit. Please let your paediatric diabetes team know and they will remove you from the submission so that we don't receive your data. Alternatively, you can contact the NPDA team directly at NPDA@rcpch.ac.uk and we will ensure that your personal identifiers are removed from our database. 

Can I opt out of the NPDA via any other means?

Yes. Wherever you attend clinic, you can opt out by asking your paediatric diabetes team not to submit any data to the RCPCH for inclusion in the NPDA.

Opting out of audits - Jersey

To exercise your right to opt-out of your data being used for National Audit and research, email the Clinical Audit team as HSSClinicalAuditDepartment@health.gov.je. You can also request that the processing of your data for national audit purposes is restricted through our online form. Data of Jersey patients who have opted out will be excluded from data flows to England.  

Understanding your data rights

If you have any queries or would like to make any rights requests in relation to your patient record, please contact your unit directly. Please read our page on Understanding GDPR and your data rights to see the full description of rights relating to your personal data. The page also explains common words and phrases used in our privacy notices, and describes our use of artificial intelligence (AI).

Limitations to your data rights 

In relation to the data we collect for the NPDA audit, to exercise your rights, please read the details below:

• Right of Access: The personal data we hold about you is provided by your unit. We can let you know which categories of data we collect but you will need to contact your unit directly for a copy of your personal data as they are data controllers of your patient record.
• Right to Erasure: The right of erasure does not apply to this audit because your data is being processed for the purposes of performing a task in the public interest, which in this case is for ensuring high standards of quality and safety health care. 
• Right to Object: Please see the ‘In England, can I opt out of the NPDA via the National Data Opt Out?’, ‘Can I opt out of the NPDA via any other means?’ and ‘Opting Out in Jersey’ sections above.
• Right to Rectification: Any requests to amend or update your personal data should be sent to your unit as we are not data controllers of your patient information. If we receive any requests, we will forward these to the unit.
• Right to Restriction: Any requests for restriction of processing should be sent to your Trust and they will inform us where applicable. Any requests we receive will be forwarded to your unit.   

Siaradwyr Cymraeg/Welsh Language Speakers

Archwiliad Diabetes Pediatrig Cenedlaethol – Hysbysiadau Preifatrwydd

Mae’r Bartneriaeth Gwella Ansawdd Gofal Iechyd (HQIP) wedi comisiynu’r RCPCH i redeg yr Archwiliad Diabetes Pediatrig Cenedlaethol (NPDA). Nod yr archwiliad yw monitro’r gwahanol fathau o ddiabetes mewn plant a phobl ifanc ar lefel genedlaethol. Byddwn yn olrhain ac yn cymharu safon y gofal sy’n cael ei dderbyn. Byddwn yn edrych hefyd ar y deilliannau a gyrhaeddir gan blant a phobl ifanc sy’n derbyn gofal gan unedau diabetes gwahanol ac mewn rhanbarthau gwahanol.

Mae’r hysbysiadau preifatrwydd isod yn dweud wrthych beth a wnawn gyda’ch data a sut y byddwn yn ei ddiogelu yn unol â GDPR y DU.

Pa ddata ydym ni’n casglu, a pham?

Mae HQIP, yr Adran Iechyd, ac iechyd a Gofal Digidol Cymru (IGDC) yn penderfynu sut y defnyddiwn y data a gasglwn. Mae’n yn rheolwyr data ar y cyd. Y RCPCH yw’r prosesydd data. Byddwn yn casglu data o unedau diabetes pediatrig (PDUs) ar y gwiriadau iechyd a argymhellir maent yn cynnal ar y plant a’r bobl ifanc sy’n derbyn eu gofal, yn ogystal â chanlyniadau’r gwiriadau iechyd hyn. Byddwn hefyd yn casglu data am dderbyniadau i ysbytai cysylltiedig â diabetes er mwyn adnabod tueddiadau a bod yn sail o wybodaeth i strategaethau er mwyn osgoi derbyn pobl i’r ysbyty. Mae modd gweld y set ddata lawn yma. Mae’r data a gesglir yn cael eu cadw ar weinyddion diogel sy’n cwrdd â’r holl ofynion diogelu data deddfwriaethol ac fe’u cedwir yn yr UE. Byddwn yn casglu data o PDUs yng Nghymru, Jersey a Lloegr.

Mae’n rhaid i bob ysbyty yng Nghymru a Lloegr gymryd rhan, dan gontract safonol y GIG, a Chynllun Archwiliad Clinigol ac Adolygu Deilliannau GIG Cymru 2024-2025 (National Clinical Audit and Outcome Plan 2024-2025) Mae eich data yn bwysig, oherwydd hebddo, ni fyddai modd i ni gynnal yr archwiliad hwn a byddai hyn yn ei dro yn ei gwneud yn fwy anodd gwneud gwelliannau cenedlaethol mewn gofal diabetes pediatrig.

Yn ogystal â chasglu gwybodaeth o PDUs, yr ydym hefyd yn gwahodd plant a phobl ifanc â diabetes (a’u rhieni/gofalwyr) i lenwi arolygon ar-lein o’r enw Mesuriadau Profiadau a Adroddir gan Gleifion (PREMs). Gwneir pob ymateb yn ddienw cyn  adrodd. Gallwch ddod o hyd i’r hysbysiad preifatrwydd am ein harolygon PREMs yma: https://www.rcpch.ac.uk/privacy-notices/surveys

Sail gyfreithiol prosesu – Cymru a Lloegr

Dan GDPR y DU, rhaid i ni gael sail gyfreithiol (legal basis) i brosesu eich data personol. Ystyr hyn fod arnom angen rheswm penodol i gasglu a defnyddio eich data yn ein harchwiliad. Am ein bod yn prosesu data meddygol, rhaid i ni gael caniatâd arbennig gan y GIG i wneud hynny. Caniatâd adran 251 yw’r enw am hyn ac y mae’n caniatáu i ni gasglu data sy’n peri adnabod cleifion heb ganiatâd penodol, oherwydd bod ein nod er lles y cyhoedd. Mae hyn oherwydd y bydd yr archwiliad yn helpu i wella safonau gofal diabetes pediatrig. I ddod i wybod mwy am ganiatâd adran 251, ewch at wefan yr Awdurdod Ymchwil Iechyd (Health Research Authority website).

Caniateir prosesu dan GDPR ar y seiliau cyfreithiol canlynol:
 

Erthygl 6 (1) (e) mae prosesu’n angenrheidiol i wneud tasg a gyflawnwyd er budd y cyhoedd neu wrth arfer awdurdod swyddogol a freiniwyd yn y rheolwr. Mae cyfiawnhad dros hyn trwy drefniadau comisiynu sy’n cysylltu’n ôl ag NHS England a Llywodraeth Cymru. (Tasg Gyhoeddus)

Erthygl 9 (2) (i) mae prosesu’n angenrheidiol am resymau budd y cyhoedd ym maes iechyd cyhoeddus (atodlen 1 (1) (3), megis amddiffyn rhag bygythiadau trawsffiniol difrifol i iechyd neu sicrhau safonau uchel o ansawdd a diogelwch gofal iechyd a chynhyrchion meddyginiaethol neu ddyfeisiadau meddygol, ar sail cyfreithiau’r Undeb neu Aelod-Wladwriaethau sy’n gwneud darpariaeth ar gyfer mesurau addas a phenodol i ddiogelu hawliau a rhyddid gwrthrych y data, yn benodol cyfrinachedd proffesiynol. Mae cyfiawnhad dros hyn gan mai nod yr NPDA yw sbarduno gwelliannau yn ansawdd a diogelwch gofal a gwella deilliannau i gleifion. Yn sail i atodlen 1 (1) (3) DDD 2018 ‘budd iechyd cyhoeddus’ mae Rhan 1 adran 2 Deddf Iechyd a Gofal Cymdeithasol 2012. Mae hon yn gosod dyletswydd ar yr ysgrifennydd gwladol i wella ansawdd gwasanaethau iechyd. (Budd Cyhoeddus Sylweddol)

Mae canlyniadau’r archwiliad yn cael eu cyhoeddi, o lefel genedlaethol i lefel PDU, ar ein Dashfyrddau Adrodd (Reporting Dashboards) fel bod modd i chi weld sut mae eich PDU yn gwneud. 

Byddwn hefyd yn cyhoeddi adroddiadau blynyddol a chanllawiau i gleifion a rhieni, sydd ar gael yn gyhoeddus ar ein gwefan a thrwy https://data.gov.uk/.

Ni fydd unrhyw ddata fydd yn peri eich adnabod fyth yn cael ei gyhoeddi.

Gwybodaeth a rannwn

Lle’r ydym wedi pennu fod y prosiect ymchwil yn cyd-fynd â nodau’r NPDA, gall data gael ei rannu gyda thrydydd partïon at ddibenion gwerthuso gwasanaeth neu wella ansawdd gan ymchwilwyr academaidd allanol. Rhennir data yn unig ar ffurf ddienw (oni fydd gan y sawl sy’n gwneud y cais ei seiliau cyfreithiol eu hunain dros ddal data lle mae modd adnabod cleifion) a hynny’n unig gyda chaniatâd HQIP. I HQIP gymeradwyo’r cais, rhaid i’r sawl sy’n gwneud y cais allu dangos eu bod yn cydymffurfio â pholisïau a threfniadau llym i ddiogelu data, a rhaid i amcanion yr ymchwil gael eu cymeradwyo, yn ôl y wybodaeth a ddarperir ar Wefan Deall Cyrchu Data Iechyd (Understanding Health Data Access Website) HQIP. Ni ddylid trosglwyddo data personol i wlad na thiriogaeth y tu allan i’r AEE. Gall data a wnaed yn ddienw neu grynodeb ohono gael ei rannu y tu allan i’r AEE yn ôl canllawiau HQIP.

Mae’r NPDA hefyd yn cydweithredu â’r Archwiliad Diabetes Cenedlaethol a reolir gan NHS England i gynhyrchu archwiliadau o ofal oedolion ifanc: Pobl yn eu Harddegau ac Oedolion Ifanc â Diabetes Math 1 a Phobl Ifanc â Diabetes Math 2.  Cyhoeddir adroddiadau blynyddol yn gyhoeddus trwy ein gwefan (our website) a thrwy data.gov.uk. Adroddir am bob data ar lefel unedau diabetes pediatrig unigol fel na fydd unrhyw ddata lle gellir adnabod cleifion fyth yn cael ei gyhoeddi. Mae gwybodaeth am breifatrwydd sy’n ymwneud a’r archwiliad hwn ar gael o NHS Digital.

Mae data lle mae modd adnabod cleifion a gesglir o PDU yn Lloegr yn cael ei rannu gydag NHS England bob chwarter fel rhan o strategaeth gweithredu dolen gaeedig hybrid (HCL) 5-mlynedd. Mae mwy o wybodaeth am y strategaeth ar gael yma. Bydd y data hwn yn caniatáu i NHS England ad-dalu byrddau gofal integredig am unrhyw HCL a brynwyd ac a ddarperir i gleifion yn eu hardal. Defnyddir y wybodaeth hon hefyd fel sail i raglen Getting It Right First Time (GIRFT) NHS England .

Am ba hyd y byddwch yn cadw fy nata?

Mae tîm yr NPDA yn y RCPCH yn gweithredu fel prosesydd data ar ran yr HQIP, sydd yn rheolwyr data i ddata’r NPDA. Bydd y RCPCH yn dal data’r NPDA cyhyd ag y bydd dan gontract i gyflwyno’r NPDA. Caiff yr holl ddata ei ddileu neu ei drosglwyddo’n ôl i’r HQIP o fewn pythefnos o derfyn ein contract yn ôl cyfarwyddiadau’r HQIP.

Optio allan o archwiliadau

Yn Lloegr, mae’r gwasanaeth Cenedlaethol Optio Allan o Ddata (National Data Opt-Out service) yn caniatáu i gleifion 13 oed neu hŷn (neu’r sawl sydd â chyfrifoldeb rhieni dros gleifion dan 13) optio allan o gael eu gwybodaeth wedi ei ddefnyddio at ddibenion y tu hwnt i’w gofal uniongyrchol. Mae’r Ysgrifennydd Gwladol dros Iechyd a Gofal Cymdeithasol, ar ôl ystyried y cyngor gan Grŵp Ymgynghorol ar Gyfrinachedd mewn Ymchwil Iechyd, wedi penderfynu na fydd y gwasanaeth Cenedlaethol Optio Allan o Ddata yn cael ei gymhwyso i’r NPDA.

Mae hyn oherwydd y gallai cymhwyso’r Optio Allan Cenedlaethol gyflwyno gogwydd i’r data a’i gwneud yn anodd monitro diogelwch ac ansawdd gofal mewn darparwyr gofal iechyd, a hynny’n arwain at ansawdd gwael mewn gwasanaethau gofal ac iechyd, gan beryglu diogelwch cleifion. Gallai hefyd leihau effaith y data ar wella gofal yn  lleol a chenedlaethol. Fodd bynnag, gallwch ddal i optio allan o gael eich gwybodaeth bersonol wedi ei ddefnyddio ar gyfer yr archwiliad hwn. Rhowch wybod i’ch tîm diabetes pediatrig ac fe wnânt hwy eich tynnu allan o’r cyflwyniad fel na fyddwn yn derbyn eich data. Dewis arall yw i chi gysylltu’n uniongyrchol â thîm yr NPDA ar NPDA@rcpch.ac.uk ac fe wnawn yn siŵr fod unrhyw beth sy’n peri eich adnabod yn bersonol yn cael ei dynnu allan o’n cronfa ddata. 

Alla’i optio allan o’r NPDA trwy unrhyw ddulliau eraill?

Gallwch. Pryd bynnag y dewch i’r clinig, gallwch optio allan trwy ofyn i’ch tîm diabetes pediatrig beidio â chyflwyno unrhyw ddata i’r RCPCH i’w gynnwys yn yr NPDA.

Deall eich hawliau data

Os oes gennych unrhyw ymholiadau neu yr hoffech wneud unrhyw geisiadau hawliau yng nghyswllt eich cofnod fel claf, cysylltwch â’ch uned yn uniongyrchol. Darllenwch ein tudalen ar Ddeall GDPR a’ch Hawliau Data (Understanding GDPR and your data rights)  i weld disgrifiad llawn o’ch hawliau sy’n ymwneud â’ch data personol. Mae’r dudalen hefyd yn esbonio geiriau ac ymadroddion cyffredin a ddefnyddir yn ein hysbysiadau preifatrwydd ac yn disgrifio sut yr ydym yn defnyddio deallusrwydd artiffisial (AI).

O ran y data a gasglwn i archwiliad yr NPDA, i arfer eich hawliau, darllenwch y manylion isod:

• Hawl i Gyrchu: Mae’r data personol a ddaliwn amdanoch yn cael ei ddarparu gan eich uned. Gallwn roi gwybod i chi pa gategorïau o ddata a gasglwn ond bydd angen i chi gysylltu’n uniongyrchol â’ch uned am gopi o’ch data personol am mai hwy yw rheolwyr data eich cofnod fel claf.
• Hawl i Ddileu: Nid yw’r hawl i ddileu yn gymwys i’r archwiliad hwn oherwydd bod eich data yn cael ei brosesu er mwyn gwneud tasg er budd y cyhoedd, sef yn yr achos hwn, sicrhau safonau uchel o ansawdd a diogelwch mewn gofal iechyd. 
• Hawl i Wrthwynebu: gweler yr adrannau ‘Yn Lloegr, alla’i option allan o’r NPDA trwy’r gwasanaeth Cenedlaethol Optio Allan o Ddata?’ ac ‘Alla’i optio allan o’r NPDA trwy unrhyw ddulliau eraill?’ uchod.
• Hawl to Gywiro: Dylai unrhyw geisiadau i newid neu ddiweddaru eich data gael ei anfon at eich uned gan nad ni yw rheolwyr data’r wybodaeth amdanoch fel claf. Os byddwn yn derbyn unrhyw geisiadau, byddwn yn eu hanfon ymlaen at yr uned.
• Hawl i Gyfyngu: Dylai unrhyw geisiadau am gyfyngu ar brosesu gael eu hanfon at eich Ymddiriedolaeth ac fe fyddant hwy yn rhoi gwybod i ni lle bo hynny’n gymwys. Bydd unrhyw geisiadau a dderbyniwn yn cael eu hanfon ymlaen at eich uned.   

 

Gwybodaeth bellach a sut i gysylltu â ni

 Os hoffech fwy o wybodaeth am yr NPDA, cysylltwch â npda@rcpch.ac.uk neu ffoniwch ni ar 020 7092 6167.  Os oes gennych unrhyw gwestiynau neu bryderon am y modd y rhennir eich gwybodaeth at ddibenion yr archwiliad, cysylltwch yn gyntaf â’ch tîm diabetes. 

NHS England a HQIP yw cyd-reolwyr data yr archwiliad hwn. Mae modd cysylltu â HQIP hefyd os oes gennych unrhyw gwestiynau neu bryderon am y modd mae eich gwybodaeth yn cael ei ddefnyddio ar gyfer yr archwiliad: data.protection@hqip.org.uk   Os oes gennych unrhyw bryderon am y modd mae eich data personol yn cael ei brosesu gan y RCPCH, gallwch hefyd gysylltu â Swyddog Diogelu Data y RCPCH: information.governance@rcpch.ac.uk 

Os ydych yn byw yn y DU, mae gennych hawl hefyd i gyflwyno cwyn am y modd y mae eich data personol chi/eich plentyn yn cael ei drin: casework@ico.org.uk.

Further information and how to contact us 

If you would like more information about the NPDA, please contact npda@rcpch.ac.uk or call us on 020 7092 6167.  If you have any questions or concerns about how your information being shared for the purposes of the audit, please first contact your diabetes team. 

NHS England and HQIP are the joint data controllers of this audit. HQIP can also be contacted if you have any questions or concerns how your information is being used for the audit: data.protection@hqip.org.uk.  If you have any concerns about how your personal data is being processed by RCPCH, you can also contact RCPCH’s Data Protection Officer: information.governance@rcpch.ac.uk.
If you live in the UK ,you do also have the right to lodge a complaint with the ICO if you have concerns about the way your/your child’s personal data is being handled: casework@ico.org.uk. If you live in Jersey you can complain to the Jersey Office of the Information Commissioner.

Last reviewed: 30 July 2025