Privacy notice

We’re the professional regulator of nurses and midwives in the UK, and nursing associates in England.

There are a number of places where you can find out how we use personal information. This privacy notice tells you generally how we use information as a regulator. We also have more detailed information about how we use personal data in the context of registration, fitness to practise and education.

You can find out about how we might use your information:

if you’re on our register or involved in one of our registration processes
if you were on the Covid-19 temporary register
if you've lapsed from our register
if you’re involved in a fitness to practise investigation
in relation to fraud and misrepresentation
for safeguarding
if you contact our employer link service
when we engage with education institutions
when responding to enquiries and complaints
if you attend NMC events
for research purposes and stakeholder engagement
when you use our website or online services
for equality and diversity purposes
when we communicate with other organisations or people
if you have made it publicly available
if you receive newsletters from us
if you are a journalist
if you visit our premises
if you attend a virtual meeting or virtual hearing
if you ask us to make a reasonable adjustment
if you apply for a job with us
if you work for or are a representative of a supplier which provides services to us
if you apply to become a Council or partner member
if you are a Council member, partner member or associate

We also tell you about how long we keep your information for and about your data protection rights.

There’s more information in our:

If you’re one of our employees, contractors, a panel member, a supplier, a member of our Council or in one of our committees we’ll tell you about how we use your information separately.

Contact us about how we use your information

Back to top

How we use your information if you’re on our register or involved in one of our registration processes

If you’re applying for admission or readmission we’ll ask you and your education provider or employer for information about you. You need to supply this information and evidence in order for your application to be considered and processed.

The information we require includes your name, address, email address, other contact details, place of work or study, any relevant health information, details of courses you are taking or have passed, and any other information we require to maintain our register and protect the public. We’ll also collect financial information such as bank account details for collecting the registration fee.

If we require you to take a test of competence as part of our registration processes, information about you will be shared with the suppliers which provide the tests on our behalf. The information we’ll share with the suppliers to enable you to take the test of competence will include your candidate ID or reference number, name, date of birth and contact details.

If you’re going through revalidation we’ll also need information about you including your name, contact information, where and when you have been working, and details of the continuous professional development (CPD) you have completed. As part of revalidation we also require information about your reflective discussion partners and confirmers, including their names and PINs (if they’re registered with us).

If you’re applying for readmission to the register we’ll ask you for the names of three referees who can confirm that your health and character is such that you’re able to practise safely and effectively.

Confirmers

If you’re a confirmer for someone on our register, we’ll process your name and contact details and details of the confirmation. As part of our verification process, we may contact you as the confirmer to ensure the confirmation discussion has taken place

Referees

If you’re a referee for a registrant who is applying for readmission we’ll ask you to sign a declaration of health and/or character, confirming that the applicant’s health and/or character is such that they’re able to practise safely and effectively. If you’re unable to provide a supporting declaration to confirm the applicant’s health and/or character for a particular reason, we’ll ask you for the reasons.

This information will be given to the Registrar to consider when making a final decision about the application. We use the information you provide for the purposes of processing the applicant’s registration application and deciding whether or not the applicant has met our registration requirements. We may contact you to obtain further information about their registration application. Any information you provide may be disclosed to the applicant.

Your personal information will be retained as part of the applicant’s application.

If you would like to know more about providing a declaration of good health and/or character, please read our guidance on health and character.

Why we process your information

We use your information to:

process registration and revalidation applications
record and update your registration and maintain the register
contact you or your referees about your application and ask for further information
investigate any concerns we have about your application or registration. This may include using any information or documents you’ve provided to us to investigate any suspected fraudulent application to our register
advise employers who contact our employer link service
provide you with updates and reminders about your registration
help you with any queries
process your registration fee
operate your NMC Online account
communicate with you about any relevant developments
ask if you would like to participate in research or our engagement events.

The legal basis for processing your information

We are legally required to maintain our register and keep it accurate and up to date. We are also legally required to process completed registration and revalidation applications and ensure that registrants meet our registration and readmission requirements.

Where we process information about your health in connection with maintaining our register, to ensure that you are capable of safe and effective practice and assessing your fitness to practise, we do so to comply with our legal obligations and because it is necessary for reasons of substantial public interest.

We also process health information because we are under a legal obligation to make reasonable adjustments to the way we offer our services to prevent people with disabilities from being placed at a substantial disadvantage.

Where we process information about criminal cautions, convictions and offences we do so in connection with maintaining our register, to ensure that you are capable of safe and effective practice and to comply with our legal obligations.

We send relevant updates and reminders and ask people to participate in research because we think it is in the public interest and necessary to perform our overarching functions and objectives. You can, however, ask us not to contact you for these reasons.

If you don’t wish to be contacted by us about specific research projects, you can indicate this in your NMC online account on the ‘How we use your information’ page within your account. Alternatively, you can let us know that you don’t want to be contacted about specific research projects by emailing foi&dparequest@nmc-uk.org.

Further information

For more information about how we handle information in the context of our registration processes please read our Registration and revalidation information handling guidance.

Back to top

How we use your information if you were on the Covid-19 temporary register

If you were n the Covid-19 temporary register but didn't subsequently join the permanent register, we'll keep record of your name, date of registration, country of practice and any conditions of practice.

We’ll also use the information to consider any future applications you make to join our permanent register.

We’ll continue to keep your information in line with our legal obligations to retain information about those who have lapsed from our register.

If you are removed from the temporary register and later wish to be readmitted to our permanent register we may use the fact of the removal and the circumstances recorded in the temporary register when considering your application.

We’ll use your contact details to communicate with you and provide you with information relating to your registration and practice and to consult you on relevant matters.

As part of our commitment to treating everyone fairly and meeting our legal responsibilities under the Equality Act 2010 and related legislation, we’ll use information about your protected characteristics such as ethnicity, disability, gender, sexual orientation, religion and belief, if you provide this to us, to help us monitor the impact of our activities on different groups and provide guidance relevant to specific groups if required.

We may use information about your health if it is relevant to any future application you make to join the permanent register, or your work as a registered healthcare professional. For example, we may need to provide special guidance to registrants who have specific health conditions.

We may use your information for research and to analyse, to report on the composition of the register and in support of workforce analysis. We will only use anonymised data when we publish the results of our research. We may also share your information if required by law, where ordered by a court, or where it is otherwise in the public interest.

The legal bases for processing your information

We process your information to comply with a legal obligation or because it is necessary to perform a task carried out in the public interest.

We process equality and diversity information to promote and maintain equality of opportunity or treatment.

We process health information because we are under a legal obligation to make reasonable adjustments to the way we offer our services to prevent people with disabilities from being placed at a substantial disadvantage, or because it is necessary for reasons of substantial public interest.

We also process health information and equality and diversity information because it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

Back to top

How we use your information if you’ve lapsed from our register

If you’ve been on our register but your registration has lapsed we’ll keep the information we have about you as a record of your registration with us. We’ll use your information to;

inform our decision to re-admit you to the register if you apply for readmission;
share information about you with another organisation where there is a legal justification for doing so;
conduct research and analysis (for example, to analyse how many people leave our register in a given timeframe and to understand their reasons for doing so);
ask you if you would like to participate in research;
seek your views (for example on our policies and initiatives);
inform you about changes to our policies and processes for nurses, midwives or nursing associates wishing to return to practice;
contact you about campaigns encouraging former registrants to return to practice.

If you don’t want to be contacted by us about return to practice or to seek your views let us know by emailing foi&dparequest@nmc-uk.org.

We keep a basic record of your registration indefinitely to support future historical research about our register and the history of our organisation,

You can find more information here about how long we keep your information.

The legal basis for processing your information

Where we process information about former nurses, midwives or nursing associates we generally do so to comply with a legal obligation or because it is necessary to perform a task carried out in the public interest. In some situations we may have a legitimate interest in processing your data.

In some cases we may be under a legal obligation to consult with former registrants as we have a duty to consult with stakeholders whenever we produce new standards and guidance.

Back to top

How we use your information if you’re involved in a fitness to practise investigation

One of our core objectives is to protect the public. To achieve this we have a fitness to practise process to investigate concerns about people on our register. Our case examiners and practice committees will take action where appropriate.

During the fitness to practise process we’ll usually gather personal information about a range of people including:

the nurse, midwife or nursing associate subject to a referral
the person who has made the referral (referrer)
witnesses
patients
employers
colleagues and other staff connected to the referral
representatives.

Due to the nature of the fitness to practise processes we’ll frequently process very sensitive information including special category personal data. This includes information about health, disabilities and criminal convictions and cautions.

Sometimes we may need to hold or process information about you before we start our investigations. This may be because we have received some information that includes information about you, but have not received a formal referral. We won’t usually inform you that we are processing your information until we start our investigations. Sometimes we may need to wait while police carry out investigations before we are able to open our investigations. We may not be able to inform you about some information we hold about you if to do so would compromise a police investigation.

Nurses, midwives or nursing associates subject to a referral

If you’re subject to a referral we’ll usually collect your:

name
unique identifiers (PIN, PRN, employee number)
date of birth
contact information
details of the circumstances of the referral and any related remediation information (including conduct and behaviour allegations or health matters where this is relevant to the case)
employment history.

We may also ask you for other information where it is necessary to progress our investigation. Where you’re represented by a trade union appointed representative, we’ll also have your trade union information. We’ll only use this information to communicate with your representative about your case.

We’ll contact you to verify the information you have provided, update you on the progress or outcome of the referral, request further information or evidence, alert you to any orders, undertakings or warnings issued and tell you about any actions you may need to take.

We may share the fact that we are looking into an allegation about your fitness to practise with other parties where this is necessary to fulfil our regulatory and public protection objectives. We exchange information with people who can help us with our investigation, including referrers, witnesses, and employers. Where relevant we may contact other regulators, police and court services, education providers, representatives or any other source which is able to provide information we need to process the referral.

We’ll need to share information about you with statutory public inquiries or inquests where we are legally required to do so. We will also share information with non-statutory public inquiries when it is in the public interest to do so.

We’re required to publish some fitness to practise information. We do this on our website in line with our FtP publication guidance.

If you think that we’re publishing something about your fitness to practise that we should not be, please email foi&dparequest@nmc-uk.org. You’ll need to give us your:

PIN
case reference number
a link to the information you want removed
the reasons why you want it to be removed and any evidence in support of your request.

Where we publish information about your Fitness to Practise case in line with our publication policy we can’t ask search engines to de-list information about the outcome of your case.

Journalists may attend hearings to observe and report on proceedings, other than where the hearings – or parts thereof - are held in private. For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance and our FtP publication guidance. Our guidance on FtP information which we can provide to journalists explains what information we will provide to the media.

Referrers

If you have made a referral to us, we’ll ask you to provide information that we think is necessary to investigate your referral. We’ll usually ask for your:

name
contact information
unique identifiers (PIN, PRN, employee number)
job title
Agreement for us to share your referral with third parties.

Depending on the case, we may need to ask you for more information, such as employment information, the circumstances surrounding the allegation and any other relevant information connected with the referral.

We may share the fact that you made a referral to us where necessary with people who can help us with our investigation, including employers, the registrant subject to the referral, education providers, law enforcement, other regulators and the courts.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

Witnesses

We’ll contact you to be a witness in one of our fitness to practise cases if we think that you can help us with our investigation. We have a dedicated service for witnesses. You can more information about what support is available on our website.

If we contact you about a fitness to practise case, we’ll usually ask for your:

Name
Contact information
Unique identifiers (PIN, PRN, employee or patient number)
Job title

We’ll also ask you to provide any relevant information you can that may help our investigation. This may include employment records, the circumstances surrounding the allegation, education history and any other information connected with the case we are looking into.

The information you give us may be put into a witness statement and you may be asked to give evidence at a fitness to practise hearing. Hearings are generally held in public, unless the hearing relates to a person’s health.

We are also obliged to publish the outcome of our hearings. For more information about the information we publish see our FtP Publication guidance.

We may share the fact that you are a witness in a case where necessary. We exchange information with people who can help us with our investigation, including employers, the registrant subject to the referral, education providers, law enforcement, other regulators and the courts.

We may collect information about your health, age, maternity status and ethnicity in order to understand if you need any extra support during the fitness to practise process.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

If you’re a patient involved in an investigation

We sometimes need to gather information relating to patients or service users. This will usually be where we need patient information or records in order to fairly assess, investigate or adjudicate a referral.

If you’re a patient or service user we may contact you directly, or indirectly via your healthcare provider or service provider, if we think you can help us with our investigation. If we need your health information, for example medical records, we’ll ask you or your healthcare provider to send them to us. We’ll only use your health information when it is necessary for the purposes of complying with our legal obligations as a healthcare regulator.

There may be instances where we get more information about you than what we need. Our usual practice is to redact any information that we don’t need for our investigation. The exception is where we need to take emergency action to stop someone from practising or restrict their practice to protect the public.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

If you employ someone we’re investigating

If you’re an employer and make a referral to us about a member of your staff we’ll usually need your:

name
work contact details
job title

We’ll ask you for any relevant information you have about the referral so that we can carry out our investigation. This may include the outcome of confidential disciplinary investigations.

We may also ask you to share personal information about third parties with us, such as patients, staff members involved in the incident and other potential witnesses. We’ll typically ask for their names, contact information and how they were involved in the incident so that we can decide whether we need to contact them directly.

We may share the fact that we have received a referral from you where necessary with people who can help us with our investigation, including the registrant subject to the referral, education providers, law enforcement, other regulators and the courts.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

Representatives

The person we’re investigating may provide us with the details of a person they wish to represent them during the fitness to practise process, such as a colleague, lawyer or a trade union representative.

If you’re a representative we’ll keep a record of your:

name
contact information
the organisation you work for.

We keep this information so that we can contact you in respect of our investigation. We’ll usually provide you with a copy of any formal correspondence that we send to the registrant you are representing.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

If you attend a virtual Fitness to Practise hearing

If you attend a virtual hearing, you will be asked to join the hearing by video conference. Our video conference system creates a transcript of the meeting.

If you use our support services

We offer informal face-to-face and telephone support to witnesses and members of the public affected by the incidents we’re investigating. We don’t write everything down that’s said to us in this context. The information we collect will generally be used to help us to communicate with witnesses and members of the public effectively and to help us meet their individual support needs.

We’ll keep any personal information that’s shared with us in this context confidential. However, if we receive information that’s related to our investigation that hasn’t already been shared with our investigation team, this will need to be shared with them. We’ll always let the people using our support services know if this needs to be done.

How we process personal data of people who are subject to referrals to the Disclosure and Barring Service and Disclosure Scotland or are subject to information requests from them

In certain circumstances we’re able to disclose information relating to a person’s fitness to practise to a third party. We’ll usually decide to share fitness to practise information with other regulatory bodies and organisations such as the police where it’s in the public interest. Where possible we will tell you before we share information about you and give you the opportunity to raise any objections.

We’re also under a legal obligation to tell the national vetting and barring agencies about the outcome of fitness to practise investigations where certain conditions are met. This includes where one of our practice committees has made a decision on a case where there has been harm, or a risk of harm posed to children or vulnerable adults.

If the conditions for disclosure are met, we provide the Disclosure and Barring Service and Disclosure Scotland with the registrant’s registration status and any relevant information about their fitness to practise case.

For more information about how we handle personal data in the context of fitness practise proceedings see our Fitness to practise information handling guidance.

Agreed removal

If you’re removed from the register by agreed removal we’ll keep information about the reason for the agreed removal and we’ll amend our register so that ‘removed by agreement –standing fitness to practise question’ is displayed against your name. We’ll usually publish a brief summary of the regulatory concern and the reasons for our decision to agree removal.

We may share the details of regulatory concerns with potential employers or recruitment agencies where it is in the public interest for us to do so. We may share information about regulatory concerns with the Disclosure and Barring Service (DBS).

The legal basis for processing your information in relation to fitness to practise

We’re legally required to effectively protect the public from registrants whose fitness to practise is impaired. In certain circumstances we’re also required to give the Disclosure and Barring Service and Disclosure Scotland personal information about a registrant who is the subject of a referral.

In most cases we only process personal data in relation to fitness to practise cases because it is necessary to meet these legal obligations. Where we’re not processing information because we’re under a legal obligation, we’ll make sure we tell you about this and tell you of any rights you may have.

Back to top

Fraud and misrepresentation

If we believe that you may have attempted to gain entry to our register fraudulently we’ll process information about you to investigate the concerns we have become aware of. We may share information about you with employers, test providers, overseas regulators, NHS Counter Fraud, government departments, the police and law enforcement agencies.

If we become aware that you have been or may have been mispresenting yourself as a nurse, midwife or nursing associate we’ll process information about you in order to investigate the concerns we have become aware of. These may include concerns that you have falsely claimed to be on the NMC register or used titles that are restricted to persons on the NMC register. We may share information about you with the police and law enforcement agencies.

The legal basis for processing your information

We process your information to comply with a legal obligation or because it is necessary to perform a task carried out in the public interest.

We are legally required to maintain our register and keep it accurate and up to date. We are also legally required to investigate concerns about misrepresentation and fraudulent entry to our register.

Safeguarding

As a healthcare regulator and registered charity, we take our safeguarding responsibilities very seriously. We’ll share information about safeguarding concerns with the appropriate agencies where there is reason to suspect a child or adult at risk is experiencing, or at risk of experiencing, harm.

The legal basis for processing your information

Where we process personal data for safeguarding we do so to comply with a legal obligation or because it is necessary to perform a task carried out in the public interest.

How we’ll use your information if you contact our employer link service

We work with employers in health and social care to make sure referrals are appropriate and include relevant information. When you call our employer link service we’ll usually ask for your:

name
job title
organisation
telephone number
postal address
email address.

We’ll also ask for information about the registrant you’re seeking advice about. This’ll normally include their PIN, name, place of work, fitness to practise concerns (including health matters and cautions and convictions), information about disciplinary matters such as dismissal or likely dismissal from work and previous referral history.

We’ll use this information to check that the person is on our register, whether the registrant has been referred to us before and to put your enquiry into context in order to provide good advice.

Why we process your information

We may use your information to:

check you’re an employer or have authority to call us
give you advice
make sure you make a referral where we have advised you do so
ask if you would like to participate in research or our engagement events.

The legal basis for processing your information

In the exercise of our statutory functions and objectives we are required to effectively protect the public from registrants whose fitness to practise is impaired.

We may invite you to participate in research if we think it is in the public interest and/or necessary to perform our overarching functions and objectives. You can however ask us not to contact you for these reasons by emailing us at foi&dparequest@nmc-uk.org.

Back to top

How we use personal data when we engage with education institutions

Students

If you’re a student we may contact you to ask whether you’d like to take part in a quality assurance review, be involved in our consultations, attend an event or participate in research.

We will also process information about you if you contact us to make a complaint.

If you work for an education provider

We may collect information about you if you work for an education provider or participate in our education quality assurance processes.

We’ll collect your name and contact information. If you’re taking part in one of our quality assurance reviews we’ll also collect details of your professional experience.

During quality assurance reviews, education institutions may provide a significant amount of supporting documentation to help the visitors reviewing the education institution to write their reports. This documentation can sometimes contain personal information, such as CVs of academic staff or minutes of meetings. This information will only be accessed by those who need to see it as part of our quality assurance process.

Why we process your information

If you’re a visitor we may use your information to:

decide whether you should take part in a quality assurance review
publish that you have produced an independent report of an approved education institution
ask whether you wish to be involved in our consultations, attend an event or participate in research.

If you work for an education provider we may use your information and any other information you give to:

contact you about your education institution as part of our quality assurance activities
produce quality assurance reports, which are usually published on our website
ask whether you wish to be involved in our consultations, attend an event or participate in research.

You have the right to object to us contacting you to participate in our consultations, events and research. To exercise this right please contact foi&dparequest@nmc-uk.org.

For more information about how we handle information in this area refer to our Professional Practice information handling guidance.

The legal basis for processing your information

We’re legally required to ensure our education standards are being met, and must appoint independent reviewers to quality assure approved education institutions. Any personal data that we process as part of our quality assurance processes is either necessary for contractual reasons or to fulfil our legal obligations of ensuring our standards are met.

We’re required to consult with people when we set new standards. The legal basis for contacting you in relation to any of our standards, research or stakeholder engagement work is that it’s necessary to perform a task carried out in the public interest and/or in exercising our official authority as a regulator.

Back to top

How we use personal data when responding to enquiries and complaints

If you contact us to make an enquiry or to complain about us we’ll ask for your contact details so that we can respond to you, provide you with updates or request further information. This includes requests we receive under data protection and freedom of information legislation.

Before we answer your enquiry or respond to your complaint we may also need to ask you for information to verify your identity. This will typically include your name, address, phone number, email address and any unique identifiers such as PIN, and date of birth which we need to identify you.

We may process sensitive information about you, such as health information or cautions and conviction data, where it is necessary for us to answer your enquiry or respond to your complaint. We might also have to look at other people’s personal data to inform our response.

We sometimes use information from enquiries and complaints for learning and statistical purposes. We’ll remove any information which can identify a person from any reports we produce.

How we’ll communicate with you

We’ll contact you using the contact details you have provided to us. Where you have indicated a preference for one form of communication we'll try to honour that request but may not always be able to do so.

If you phone us

If you phone us we’ll record relevant information about the call. This includes the time and date of the call as well as your telephone number. We monitor volumes to our call centre and some calls will be recorded to help us train colleagues and monitor the quality of support we provide. We might use the recording to check details about fitness to practise referrals and complaints.

The legal basis for processing your information

Any personal data we process to answer enquiries and complaints is because it is necessary to perform a task carried out in the public interest and/or in exercising our regulatory functions.

If you object to us using your personal data for this reason you can email us at foi&dparequest@nmc-uk.org.

Back to top

How we use your information if you attend one of our events

If we ask you to attend an event run by us or for us we collect information such as your name, job title and contact information. We may also take photographs to document the event.

We’ll use your information to contact you and provide you with updates and information about the event you’re attending or have attended. We may also contact you to provide you with information on related events or topics.

If you don’t wish to continue receiving such information or invitations you can request that we no longer send these communications to you by emailing communications@nmc-uk.org.

Photography at events

Where we wish to take photographs of you at an event we’ll ask your consent to do so.

When you consent to us using your image you are agreeing to:

Provide your phone number so that we can contact you for permission to use your image for further purposes. We will not use your image for further purposes without your consent. Your contact information will not be passed on to any third parties and will only be used by our communications team.
Allow us to share your image with photographers and design agencies that we work with. The photographers and agencies will keep your image for up to five years. They will only use the images for our work and will not publish or share them for any other purpose.
Allow us to use your image in publications, email newsletters, on our website and intranet, and on social media for up to five years, after which time we will delete your image and contact details. Your image might appear in publications already in circulation after this point.

You can withdraw consent at any time, and we’ll delete all photos that we hold of you. You should be aware that although we can replace your photo on pages of our website, we might not be able to replace it on all copies of files or PDFs that we’ve already published.

To ask for a copy of your images, or to withdraw your consent, please email communications@nmc-uk.org.

If you attend a virtual event
If you attend a virtual event, our video conference system will process information about you. We record some meetings so that people who can’t attend the meeting will be able to view the meeting content later. We’ll let you know if a meeting is going to be recorded.

Legal basis for processing
We’re required to engage with the people affected by our work. The legal basis for contacting you about any of our events is that it is necessary to perform a task carried out in the public interest and/or in exercising our official authority as a regulator.

Where we wish to take photos of you at an event we rely on your consent to do so.

Back to top

How we use your information for research and stakeholder engagement

As part of our role we do a number of research activities. These include statistical analysis of data we hold and combining our data with other sources, such as information from employers, or publicly available data, to identify any trends.

The reason we conduct research is to:

improve our customer service
evaluate and improve our policies
allow anyone with an interest in the regulation of nursing and midwifery to contribute to consultations and analyse the results of these
analyse trends in the composition of our register
analyse our performance against legal obligations such as equality legislation.

We may use your information to contact you about consultations.

The legal basis for processing your information for research and stakeholder engagement

We carry out research which is relevant to our regulatory functions. In general, if we carry out research or ask you to participate in research we do so because it is necessary to perform a task carried out in the public interest and/or in exercising our official authority as a regulator.

When we consult, we do so in the public interest and in exercising the official authority vested in us.

You have a right to object to the use of your information for research purposes or for stakeholder engagement. If you wish to object to your personal data being used for research contact us at foi&dparequests@nmc-uk.org.

Back to top

How we use your information when you use our website or online services

We collect personal information from people who use our website, microsites, and NMC Online through the use of online forms. The information collected may include the IP address from which you accessed our services.

The information we collect and why we collect it depends on the online services being used. The ways in which we process personal data are set out in more detail elsewhere in this privacy notice.

We use information we have collected from our websites for statistical analysis. We collect internet log information and details of visitor behaviour patterns in order to find out the number of visitors to the various parts of our websites. This information is collected in a way which does not identify individuals. In the event that we do want to collect personal data via our website, this will be made clear to you at the time. When this happens, we’ll explain what we intend to do with your personal information.

Other websites

Our websites may contain links to other websites which are outside our control and are not covered by this privacy notice or the various policies referred to in it. If you access other websites using the links provided on the website, the websites’ operators may collect personal information from you, which will be used by them in accordance with their privacy policy, which may differ from ours.

Cookies

Our website uses cookies. A cookie is a small piece of information sent by a web server to a web browser that enables the server to collect information from the browser. Find out more about the use of cookies.

Our website uses the ASP.NET session cookie. We also use Google Analytics cookies to collect statistics about how people use our website. The statistics we collect are anonymous and in aggregate form and are not used to identify you personally.

Our website also uses third party cookies where we embed content or use functionality from other websites. Examples of third party cookies which we use include those from Addthis, Eventbrite, Facebook, Twitter and YouTube. We don’t have any control over the setting of these third party cookies. You should check the relevant third party website for more information about these.

By continuing to use our website you agree to accept cookies used on our website. However, if you prefer not to use cookies, most browsers allow you to turn off cookies or to receive a warning before a cookie is stored on your computer hard drive. Please refer to your browser instructions or help screen to learn more about how to do this.

If you decide to disable any cookies we place on your computer you may not be able to use certain services or facilities on our website or you may find that your use of the website is restricted.

Legal basis for processing information through our websites

We operate our website and online services to perform our regulatory functions. Depending on the information and online services being used, we process personal data:

because we are under a legal obligation, for example we’re legally required to publish the names of the people on our register and the outcome of certain fitness to practise cases
because it’s necessary to perform a task carried out in the public interest and/or to exercise official authority vested in us, for example providing updates and reminders to individuals going through our registration processes
because you have consented to us processing your personal data. This will be stated clearly at the time we ask for the information.

Back to top

How we use equality and diversity information

We’re committed to treating everyone fairly and meeting our legal responsibilities under the Equality Act 2010 and related legislation.

One of the ways we do this is by asking people to provide information about their protected characteristics such as ethnicity, disability, gender, sexual orientation, religion and belief.

The information you provide will not be used to determine individual fitness to practise outcomes or registration applications.

This information helps us monitor the impact of our activities on different groups and meet legal requirements by, for example making adjustments for people with disabilities.

We gather this information as part of our registration and fitness to practise processes and when we conduct research and consultations. Sometimes this information is relevant to complaints or enquiries.

In some circumstances we make it mandatory to submit answers to diversity data questions. However, the option to answer ‘Prefer not to say’ is always available for anyone who does not wish or feel able to select any of the other options, or would like to move on to the next question.

We’ll keep the data confidential and hold it securely in line with data protection regulations. We’ll anonymise any data we publish so you can’t be identified.

The information may be used by different teams in the organisation.

We use the information you give us to analyse and report on statistical trends in nursing and midwifery practice in the UK and the diversity of our workforce.

We may use the information for research, for example to understand the impact of our processes on different groups. We may also share your information if required by law, where ordered by a court, or where it is otherwise in the public interest.

Our Diversity categories monitoring guidance outlines the standard categories we use to monitor diversity.

This guidance is used by everyone working at the NMC to ensure we’re consistent when working with diversity data or considering monitoring people’s diversity.

We may adapt and change these categories depending on the work that we’re doing.

The legal basis for processing your information

We generally process equality and diversity information to promote and maintain equality of opportunity or treatment.

In some situations we may have a legitimate interest in processing diversity data or we may have a different legal basis for processing your data. In these situations we’ll let you know at the time we collect the data our legal basis for processing your data and any legitimate interest we have in processing it.

Back to top

Communicating your information with other organisations or people

We sometimes need to share information about registrants or other individuals with legitimately interested organisations, such as other regulators and employers.

In certain instances we may need to share information with law enforcement services and courts. Sharing information regarding certain offences and conduct with vetting bodies is within our public protection remit and in some cases we also have a legal obligation to do this.

Find out more about who we work with

We take care to ensure that only the minimum information required is shared. Due to the nature of our work as a regulator of healthcare professionals this will often include sensitive information such as health information, cautions, convictions, allegations and disciplinary matters.

We share information with journalists where we consider it in the public interest to do so.

We’ll share information with contractors, providers and research organisations working with us or on our behalf. Organisations and people we share information with include approved education institutions and auditors. We also share your information with suppliers which provide services to us, including those which provide and support our technology systems.

We share information internally with our colleagues in order to perform our regulatory and business functions or to answer any enquiry or other correspondence that you’ve sent to us. In order for us to perform our regulatory and business functions, we need to process information about you in our IT systems.

We may use personal data when giving or receiving legal advice and to establish, exercise or defend legal claims.

When there’s more than one data controller for your personal data

There’ll be instances where control of information overlaps with another organisation. An example is where we work with legal providers. If this happens, you have the right to contact either us or the other organisation about the use of your information.

International transfers

We sometimes transfer personal data outside the UK. We’ll generally only transfer personal data to countries outside the UK:

to respond to requests from people who want us to share their registration details with an overseas regulator
for important reasons of public interest or to prevent or detect crime
where we use a supplier to process personal data on our behalf and the supplier operates outside the UK.

We generally only transfer personal data to countries within the European Union and European Economic Area (EAA). We have policies and procedures in place to ensure that where your data is processed outside the EU/EEA it is adequately protected.

The legal basis for sharing your information

The legal basis for sharing your information will usually be to comply with a legal obligation namely because it’s necessary for us to perform a task carried out in the public interest and/or our official authority as a regulator, or for contractual reasons.

Back to top

How we use publicly available sources of information including social media

As a large regulator and public authority, we’re often talked about in the public domain. We think that it’s important to keep up to date with what the public say about our work on social media, on the internet and in the media generally. We also think that it’s a useful way to engage with our stakeholders and customers about our work.

We operate accounts on a number of social media channels (Facebook, Twitter, LinkedIn, YouTube and Care Opinion). People can contact us and make enquiries through some of these media channels. We use these accounts to see what people are saying about us and the healthcare sector in general. We may also use these accounts to answer requests or enquiries we have received, for example via Twitter.

Occasionally we may be alerted to a concern about someone’s fitness to practise via social media. We’ll refer any fitness to practise concerns for investigation where appropriate. In some cases information made public or opinions expressed on social media may be relevant to our investigations into an individual’s fitness to practise. We’ll process personal data from social media where it forms part of the evidence for our investigations or is otherwise relevant to our investigations or regulatory functions.

The legal basis for processing your information

We process personal data obtained from publicly available sources of information because it is necessary to perform a task carried out in the public interest and/or in exercising our regulatory functions. We have a legitimate interest in using publicly available sources of information to understand what is being said about us and the healthcare sector in general.

You have a right to object to us using your publicly available information in the ways set out above by contacting foi&dparequests@nmc-uk.org.

Back to top

If you subscribe to our newsletters

We collect, store and process personal data for our corporate email newsletters. Our email newsletters are:

Nurses and nursing associates newsletter
Midwifery newsletter
Education newsletter
Employers newsletter
Student newsletter
Patient and public newsletter
Panel members newsletter

These email newsletters are separate from regulatory messages and updates which we send you by email, through NMC Online or by post.

The legal basis for processing your information

You’ll only receive email newsletters from us if you have consented to us contacting you in this way. You can unsubscribe to any of the newsletters at any time via the unsubscribe link contained at the bottom of the newsletters.

Back to top

If you’re a journalist

We collect, store and process your contact details if you’re a journalist who we proactively contact about news relating to the health and social care sector or if you make media enquiries to us. We also record details of your media enquiries to us.

We process journalists’ personal data because it is necessary to perform a task carried out in the public interest and/or in exercising our regulatory functions.

How we use your information if you attend our premises

Visitors to our sites: CCTV

Closed Circuit Television (CCTV) is in operation at our sites.

Where we are not the sole occupier of the building (all offices other than 23 Portland Place) there’s additional CCTV which is controlled by the building owners or management company.

We record CCTV images of people entering and leaving our premises as well as at strategic locations throughout the buildings. This information is recorded for the purposes of security and safety monitoring and the investigation of alleged criminal offences. The images may be shared as part of disciplinary matters or with law enforcement and courts if this is needed.

We have visitor registers at our sites. If you leave your details there, they will be used for security and safety (such as in the event of a roll call following an evacuation). In certain circumstances this information may also be used in disciplinary or other investigations and passed to law enforcement agencies and courts if required.

How we communicate with you

We wouldn’t normally use the information in either CCTV recording or visitor registers to contact you. In the event that a safety, security, or criminal incident has occurred we may use information we have collected to contact you. This may be to tell you about the incident or suspected incident and to request information we may need to investigate the matter further, update you about any investigation, or to tell you of the outcome.

Legal basis for processing your information in CCTV images

We use our premises to perform our regulatory functions. We consider that ensuring the security and safety of our premises is necessary for to perform a task carried out in the public interest and/or in our official authority as a regulator.

We also consider that we have a legitimate interest in using CCTV images to keep our premises safe and secure.

For more information about how we use CCTV, you can ask to see the CCTV policy.

If you object to the way we use CCTV, you can contact foi&dparequests@nmc-uk.org.

Back to top

How we use your information if you attend a virtual meeting or virtual hearing

We use video conferencing to run virtual meetings and hearings. Your personal data is processed by the supplier which provides these systems.

We sometimes make recordings of virtual meetings. If we record a meeting that you attend we will tell you that it’s being recorded and the reason why we are recording it.

Legal basis for processing your information using our videoconferencing system

We generally process information using our videoconferencing system because it’s necessary for us to perform a task carried out in the public interest and/or in our official authority as a regulator.

How we use your information if you ask us to make a reasonable adjustment

Reasonable adjustments are changes to the way we offer our services to ensure that disabled people have a fair chance of accessing our services.

We process information about any disability or health condition you tell us about so that we can make reasonable adjustments.

We’re under a legal obligation to make reasonable adjustments to the way we offer our services to prevent people with disabilities from being placed at a substantial disadvantage and to ensure that people with disabilities have a fair and equal chance of accessing our services.

Back to top

How long we keep your information

We’ll hold and use your information only for as long as necessary for our business purposes or to meet our legal requirements or in exercising our official authority as a regulator. The length of time for which we keep your information will vary depending on the type of information it is and why we hold it.

Read our corporate information retention schedule.
Read about what information we publish about Fitness to Practise hearings in our FtP Publication guidance

If you’d like more information about how long we keep your information contact us at foi&dparequest@nmc-uk.org.

Back to top

Your rights

Right to be informed

You have the right to be informed about how and why we collect and use your information. This privacy notice forms part of our work to inform you about the information we hold about you and how we use it.

There’ll be times when it would not be appropriate for us to contact you to inform you that we have your information. This would include situations where you have supplied the information directly to us or where we don’t have contact information for you. There may be times where it could prejudice an investigation to make contact but we’ll do so once this need has passed.

You can request further information or clarification on our use of your information at any time by filling in this form or emailing us at foi&dparequest@nmc-uk.org.

Right of access

You have the right to request a copy of information we hold about you.

In most cases the information will be provided to you free of charge. Only if the request is manifestly unreasonable or excessive or is a repeated request for the same information can we apply a charge. Any charge would be based on the costs of providing the information.

Before answering a request we’ll take steps to verify the identity of the person making the request and the information we release.

There are circumstances where we’ll hold information but will not be able to provide it in response to a request. This would apply if the information was being used in an investigation and our investigation would be prejudiced by providing you with the information. It would apply if we were compelled by law not to disclose it or if doing so would interfere with the rights of another person (for example the names of other people on the same records). In such circumstances we would tell you that this is the case (unless compelled by law not to do so). We would also not supply information about a person if we haven’t been given enough details to identify them from that information.

If you wish to make a request to access your information please contact at foi&dparequest@nmc-uk.org.

Right to rectification

You have the right to ask us to rectify any information we hold if it’s incorrect.

If you ask us to correct information which has been provided as part of registration this may trigger an investigation using the Incorrect or Fraudulent Entry process to ensure the integrity of our register. Where proportionate and practical we’ll ensure that any organisation we have shared the information with also corrects it.

You should check any information about you which you provide to us and keep it up to date.

If you believe that information we have published about you online regarding a fitness to practise matter is incorrect or no longer relevant you can apply for this to be removed or amended by emailing foi&dparequest@nmc-uk.org

To ask us to correct any other information we hold about you, email us at foi&dparequest@nmc-uk.org.

Right to erasure

In some circumstances you may have the right to ask us to remove information we hold about you.

There are limitations to this right. It doesn’t arise where we are compelled by law to keep it or where it is integral to our activities as a regulator.

If you believe that information we have published about you on our website regarding a fitness to practise hearing is incorrect or no longer relevant then you can apply for this to be removed by sending an email to foi&dparequest@nmc-uk.org.

To ask us to remove any other information we hold about you, email us at foi&dparequest@nmc-uk.org.

Right to restrict processing

You have the right to ask us to restrict the processing of your information for specific purposes for specific periods of time.

In most instances due to the nature of our work the right to restrict the processing of your information does not arise. This is because we usually process information because of a legal obligation or because it is integral to our activities as a regulator.

To make a request to restrict processing by filling in this form or contacting foi&dparequest@nmc-uk.org.

Right to data portability

You have the right to request your information in a machine readable format, using common standards or file types. This right only applies where you have provided the information to us yourself and we are processing the information based on your consent or to fulfil a contract and when the processing is carried out by automated means.

Due to the nature of our work which involves complying with the legal obligations in our legislation and exercising our authority as a regulator, this right is unlikely to apply in most cases.

To make a request please you can fill in this form or contact foi&dparequest@nmc-uk.org.

Right to object

You have the right to object to us processing your information. This includes the right to object to direct marketing and the right to object to your information being used for research.

There are a number of exemptions to this right. If we’re not able to comply with your request we’ll advise you of our decision within one month of your request setting out the reasons.

You can tell us of your objection by filling in this form or contacting foi&dparequest@nmc-uk.org.

Rights related to automated decision making including profiling

You have the right to request human intervention in any automated decision making processes where this process is not based on your consent, authorised by law or necessary for the performance of a contract.

We generally don’t make decisions using automated means. Some of our registration processes are partially automated. However wherever we make a decision to refuse a person’s application for registration, this will never be automated.

If you have an enquiry about our use of automated decision making, please fill in this form or contact foi&dparequest@nmc-uk.org.

Back to top

How to contact us about your information

Fitness to practise information

If you believe that information we have published about you online regarding a fitness to practise hearing is incorrect or no longer relevant then you can apply for this to be removed or amended by emailing us at foi&dparequest@nmc-uk.org.

How to request a copy of the information we hold about you

To request a copy of the information we hold about you, email us at foi&dparequest@nmc-uk.org.

Or write to us at:

Information and Data requests team
Nursing and Midwifery Council
23 Portland Place
London
W1B 1PZ

If your enquiry is about our mailing list for events

If you’ve previously attended one of our events and have provided us with your contact details, but no longer wish to receive updates from us regarding our events email communications@nmc-uk.org.

If you’ve given consent for us to use your information

If you previously gave consent for us to you your image at one of our events and you now wish to withdraw your consent, please email communications@nmc-uk.org.

In all other cases where we rely on consent to process your information you can withdraw your consent by emailing foi&dparequest@nmc-uk.org.

For all other enquiries about how we use your information

For all other enquiries about how we use your information you can fill in this form or contact foi&dparequest@nmc-uk.org

Data Protection Officer

Our Data Protection Officer can be contacted by emailing DPO@nmc-uk.org.

Or write to us at:

Data Protection Officer
Nursing and Midwifery Council
23 Portland Place
London
W1B 1PZ

Your right to complain to the Information Commissioner’s Office (ICO)

You have a right to complain to the Information Commissioner’s Office (ICO). The contact details for the ICO can be found on their website.

I want to...