GDPR DATA SUBMISSION AND PROCESSING AGREEMENT
1. PURPOSE OF SUBMISSION
By submitting this form, you (the “Employer” or “Authorised Representative”) confirm that you are requesting occupational health advice in relation to an employee and/or worker for the purposes of:
➤ Assessing fitness for work
➤ Assessing and managing risks associated with the relationship between health, impairments of daily living, work activities and environment(s)
➤ Considering and identifying “reasonable adjustments"
➤ Facilitating attendance or performance management or return to work
➤ Supporting health, safety and wellbeing management
2. ROLES AND RESPONSIBILITIES
➤ The Employer acts as a Data Controller for the personal data submitted.
➤ The Occupational Health Provider acts as an independent Data Controller in respect of its own processing activities and determines the purposes and means of processing independently for clinical assessment and advice.
Each party acts as a separate and independent Data Controller and is responsible for its own compliance obligations.
Each party will comply with:
➤ Applicable common law duties of confidentiality
➤ UK GDPR
➤ Data Protection Act 2018
➤ Applicable occupational health professional and ethical standards
3. LAWFUL BASIS FOR PROCESSING
The Employer confirms that:
➤ A lawful basis exists for processing and sharing personal data, including (where applicable):
➢ Article 6 UK GDPR (e.g. legitimate interests, legal obligation, or contract), and
➢ Article 9 UK GDPR condition for processing special category data
➤ The processing is necessary, proportionate, and limited to what is required to achieve the stated purpose
4. EMPLOYEE AWARENESS AND TRANSPARENCY
The Employer confirms and warrants that:
➤ The employee/worker has been informed in advance of the occupational health referral
➤ The purpose, nature, and intended outputs of the referral have been clearly explained, including that an occupational health report may be produced and shared
➤ The employee/worker has been provided with, or signposted to, a Privacy Notice explaining how their personal data will be used
5. CONSENT AND DATA SHARING PRINCIPLES
The Employer acknowledges and agrees that:
➤ The Occupational Health Provider will seek explicit, informed consent directly from the employee before any health information is disclosed to the Employer;
➤ No medical information will be shared without employee consent unless required by law, including where there is a serious and imminent risk to health or safety;
➤ Any information shared will follow the “minimum necessary” principle, typically limited to:
➢ Functional capacity
➢ Fitness for work
➢ Recommended adjustments
➤ Clinical diagnoses will not normally be disclosed to the Employer.
6. NATURE OF DATA SUBMITTED
The Employer agrees:
➤ To submit only data that is relevant, adequate, and limited to what is necessary for the referral
➤ Not to include excessive, irrelevant, or highly sensitive data unless strictly required
➤ That submitted information may include personal and (potentially) special category data
7. SECURITY AND HANDLING OF DATA
The Employer confirms that:
➤ Personal data submitted has been obtained and is shared securely, lawfully, and in accordance with its internal data protection policies
➤ Internal organisational controls are in place to protect personal data
➤ Access to occupational health reports within their organisation will be restricted to authorised personnel on a need-to-know basis
8. DATA RETENTION AND FURTHER SHARING
The Employer agrees that:
➤ Occupational health reports provided will be treated as confidential, sensitive data;
➤ Further sharing within the organisation will be:
➢ On a strict “need to know” basis by authorised individuals responsible for managing the employee’s health, safety, or employment needs and responsibilities, and
➢ Only where necessary for employment, health and safety, legal or safeguarding purposes.
➤ The Employer will ensure that occupational health information is not used for purposes unrelated to employee health, safety, or wellbeing without an appropriate lawful basis;
➤ The Employer will retain occupational health reports only for as long as necessary and in accordance with its retention policies and legal obligations;
➤ Any further disclosure to third parties will require:
➢ An appropriate lawful basis, and where applicable, further employee consent.
9. EMPLOYEE RIGHTS
The Employer acknowledges that employees retain their rights under UK GDPR, including:
➤ Right of access
➤ Right to rectification
➤ Right to restrict or object to processing
➤ Rights relating to automated decision-making (where applicable).
10. NO CONSENT / WITHDRAWAL OF CONSENT
The Employer understands that:
➤ If the employee does not consent to the release of occupational health advice:
➢ The Employer may receive a notification of “no consent” only;
➢ No health information will be disclosed
➤ Consent may be withdrawn by the employee at any time prior to disclosure.
11. CONTACT AND QUERIES
For data protection queries, requests, or concerns, the Employer should contact their internal Data Protection Officer and/or the Occupational Health Provider’s Data Protection Lead.