National Obesity Audit dataset

Summary

Why and how we process your data in the National Obesity Audit and your rights.

Controller	NHS England
How we use the information (processing activities)	The National Obesity Audit (NOA) is part of the National Clinical Audit and Patient Outcomes Programme (NCAPOP). The aim of the audit is to measure how well weight management services are doing to inform policy and guidelines for managing obesity across the NHS and local authorities. It will also be used for benchmarking and to enable NHS providers to maximise the use of their resources and to improve patient outcomes. The NOA dataset holds personal data relating to patients living with overweight or obesity, including: demographic information – such as NHS number, date of birth, postcode, sex and ethnicity health information – such as Body Mass Index (BMI), obesity related co-morbidities, healthcare interventions such as weight loss advice and bariatric surgery NOA data will be used to create regular statistical publications on the NHS England website including dashboards and an annual report. All data published is anonymous and aggregate so that patients cannot be identified from the data. For more information see the full NOA Transparency Notice.
Does this contain sensitive (special category) data such as health information?	Yes
Who are recipients of this data?	Data from this collection may be shared with organisations for planning, commissioning and research purposes where there is a benefit to health and social care. Organisations will need to apply and gain approval through our Data Access Request Service.
Is data transferred outside the UK?	This data is not transferred out of the UK
How long the data is kept	Minimum of 20 years, with regular reviews in accordance with the NHS Records Management Code of Practice and NHS England Corporate Records Retention and Disposal Schedule.
Our lawful basis for holding this data	Legal obligation
Your rights	Be informed Get access to it Rectify or change it Erase or remove it Restrict or stop processing it Move, copy or transfer it Object to it being processed or used Know if a decision was made by a computer rather than a person
How can you withdraw your consent?	Consent is not the basis for processing.
Is the data subject to decisions made solely by computers? (automated decision making)	No
Where does this data come from?	The NOA makes use of data already held by NHS England in other data collections that we are responsible for managing. This includes relevant data from the Community Services Dataset (CSDS), Hospital Episode Statistics (HES), Cardiovascular Disease Prevention Audit (CVD Prevent). NHS England collects the above datasets from health and care providers in community, primary and secondary care settings.
The legal basis for collecting this data	UK GDPR Article 6(1)(c) - legal obligation (the National Obesity Audit Directions 2023, under s.254 of the Health and Social Care Act 2012). UK GDPR Article 9(2)(g) - Substantial public interest, plus Schedule 1, Part 2, Paragraph 6 “statutory etc and government purposes” of DPA 2018. UK GDPR Article 9(2)(h) - Health or social care purposes, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018.