Surgical Devices and Implants data collection transparency notice

This collection supports the development of a single Surgical Device and Implants Information System, to enable the national reporting of the use of any surgical device or implant.

The data will help improve patient safety by making it easier and quicker to identify adverse outcomes with particular devices, so that any issues can be investigated promptly. This will include

• comparing surgical device and implant outcomes to the outcomes where patients have had alternative procedures that did not involve a surgical device or implant for the same medical conditions
• supporting the identification of patients and verifying their latest address to enable patients to be contacted by their health care organisation if their implanted device needs to be reviewed or removed if an issue with a particular device has been discovered

Your personal data, including data related to your health will be collected if you have had a surgical device or implant for a medical condition or if you have had an alternative procedure carried out for the same condition but which did not involve a surgical device or implant. This data will include

• your NHS number
• your family name
• your first name
• your current postcode
• your date of birth
• the surgeon, and other clinicians involved in your care
• the details of the surgical procedure you had
• the details of the implant used in your surgery
• information about your state of health pre and post treatment
• post-operative outcome information collected from you by your clinicians or submitted by you as part of the review of your care

Data is submitted securely to NHS Digital by NHS and independent sector health and care organisations. These organisations are legally obliged to provide us with the information as set out in the Data Provision Notice issued to them under section 259(1)(a) of the Health and Social Care Act 2012. The Data Provision Notice is published. 

Quality checking

The data we collect is checked and quality assured by skilled analysts. If necessary, they will check with the organisation who sent us the data to make sure it is correct and complete.

Analysis and linkage

We analyse and link the data we collect to other patient data NHS Digital already holds, so that we can identify how well your device is working and investigate the longer-term effects of surgical devices and implants on your health.

Publishing statistics

We will use the data to publish national statistics and data outputs that contain only anonymous data which cannot be used to identify individuals. We never publish any data that could identify you.

NHS Digital treats the data with great care. All data which is shared by NHS Digital is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will ever be shared.

Wherever possible, de-personalised data or anonymous data is used and shared to protect patient confidentiality. We also apply the National Data Guardian’s Caldicott Principles to ensure we only provide the minimum amount of data necessary for the purpose for which it is to be used. To support your direct care, personally identifiable data can be shared, but this is always done in accordance with the law and subject to safeguards to ensure that the data is kept safe and secure.

Data is shared or is expected to be shared with organisations such as health care organisations, clinicians, commissioners of NHS services, and the Medicines and Healthcare products Regulatory Agency (MHRA), for example:

• the organisation that provided your care: to assess the effectiveness of your care, to improve the services they offer and in the event you need to be contacted about issues affecting your device that require follow-up action
• MHRA: to support analysis of patient outcomes relating to surgical devices and implants to identify possible incidents requiring investigation alongside intelligence they receive through the Yellow Card Scheme
• Commissioning organisations (CCGs) and other bodies which are responsible for arranging the provision of health services in England, such as Integrated Care Boards: to help plan and improve NHS healthcare services
• research organisations, including universities and charities: to carry out research

Details about the surgical devices and implants data shared with other organisations, except for anonymous data, are published in the Data Uses register. 

This applies to identifiable patient data about your health which is called confidential patient information. If you do not want your confidential patient information to be shared by NHS Digital for purposes except for your own care, you can register a National Data Opt-out. 

You can find out more about and register a National Data Opt-out or change your choice. 

NHS Digital will keep surgical devices and implants data for as long as it is necessary for the purposes outlined above in accordance with the Records Management Code of Practice 2021 and our Records Management Policy. This is currently a minimum of 20 years after death.

Other organisations that NHS Digital shares your personal data with must only keep it for as long as is necessary and as set out in their Data Sharing Agreement. Information about this will be provided in their privacy notices on their websites.

Surgical devices and implants data will be stored and processed within the United Kingdom (UK).

We have been given a legal instruction to collect and analyse data about surgical devices and implants, and to collect and analyse data about alternative procedures for the same medical conditions which do not result in a surgical device or implant.

This legal instruction is known as a direction, which we received from the Secretary of State for Health and Social Care, under section 254 of the Health and Social Care Act 2012. The direction is called the Surgical Devices and Implants Directions 2020. It provides the legal basis for NHS Digital to collect and use surgical devices and implants data for the purposes set out above. The scope of the surgical devices and implants data collected is set out in the requirements specification.

Under the UK General Data Protection Regulation (GDPR), NHS Digital can only collect and use personal data if there is a legal basis under Articles 6 and 9 of the UK GDPR.

Our legal basis for collecting and analysing personal data is Article 6(1)(c) - legal obligation: the processing is necessary to comply with the law, as NHS Digital is required to do this by the direction.

Our basis for processing personal data related to health (special category data) is Article 9(2)(g). This is because the processing of the data is substantially in the public interest and in accordance with the law, for the purposes of NHS Digital exercising its statutory functions under the direction. It is substantially in the public interest to collect and use surgical devices and implants data as the aims are to improve patient safety, to improve future treatments, and to enable patients to be traced in the event of a safety concern relating to an implant or treatment. This processing is also permitted under paragraph 6 of Schedule 1 of the Data Protection Act 2018.

You can read more about the health and care information collected by NHS Digital, and your choices and rights in

• How we look after your health and care information
• NHS Digital Transparency Notice
• How to make a subject access request

Our Data Protection Officer is Jon Moore who can be contacted at [email protected].

NHS Digital may make changes to this Transparency Notice. If so, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.

NHS Digital has been directed by the Secretary of State for Health and Social Care under section 254 of the Health and Social Care Act 2012. This instructs NHS Digital to collect and analyse surgical devices and implants data from NHS health and care organisations in England.

HCOs are legally required to submit returns of surgical devices and implants data, in accordance with the Data Provision Notice DPN issued to them under section 259(1)(a) of the 2012 Act. However, HCOs may themselves exclude records that are subject to any other restriction on disclosure, such as by other laws.

Patients using the services covered by the surgical devices and implants data collection must be made aware by the HCO that their personal data will be shared with NHS Digital.  

Ensuring fairness is the responsibility of the HCO from which the data will be collected.

HCOs can be assured that the processing of this information will not have any adverse impact upon their patients as the data will be held securely, with limited access for those NHS Digital employees with the requisite clear data access in line with standard NHS Digital processing. Any published outputs are in aggregate anonymous form with disclosure control applied, which ensures patients are not inadvertently identified.