eGDCPrivacy
About our Privacy Notice
Last updated: 27 October 2025
This is the privacy notice for the General Dental Council (GDC). It tells you what information we hold about you and how we use it, explaining this is part of our responsibility under data protection law.
We will give you a more detailed explanation when we need to, for example when we collect information from you because you are involved in a hearing, or when you register with us.
This notice also explains your rights in relation to any personal data that we process, as under data protection law, the GDC is known as the ‘controller’ of the information we hold about you. The GDC processes personal data on the basis that it is performing a public task in respect of its statutory function under the DA 1984 – Article 6(1)(e).
We are accredited to international information security standards and are Cyber Essential Plus certified, which means that we keep your information safe and secure. We also adhere to the ICO Accountability Framework [Link to https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/accountability-framework/] which is a standard to measure organisations’ compliance with Data Protection Law.
The way in which we process personal data is governed by data protection law, which is primarily the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 (“DPA”) and the Data Use and Access Act 2025 (“DUAA”).
The following terms are defined by the UK GDPR, the DPA and DUAA.
By personal data, we mean information relating to a living identified or identifiable person.
By special category personal data, we mean:
- Personal data that reveals any of the following about an individual: racial or ethnic origin; political opinions; religious or philosophical beliefs; or trade union membership.
- Personal data that consists of: genetic data; biometric data used for the purpose of identifying an individual; data concerning health; or data concerning an individual’s sex life or sexual orientation.
By criminal offence data we mean personal data about whether an individual is alleged to have committed or has been convicted of a criminal offence.
What rights do you have?
Under data protection law, primarily the UK General Data Protection Regulation (UK GDPR) and DPA 2018, you have rights over the information we hold about you.
- You can ask us to give you access to your personal data
- You can ask for your personal data to be erased.
- You can ask us to restrict the processing of your personal data, so that the data will only be used for limited purposes.
- You can object to the processing of your personal data.
- You can ask for your personal data to be provided to you in a structured, commonly used and machine-readable format, and you can transmit that data to another data controller.
- You can make a request for any of these by contacting us here.
- You can contact the GDC's Data Protection Officer here.
- You can find out more about your rights on the Information Commissioners Office website.
Privacy notice sections
How we use your personal data when you contact the GDC
How we use personal data in Registration
How we use personal data in fitness to practise – initial assessment, assessment and investigation
How we use personal data in fitness to practise - prosecution and hearings
How we use personal data in fitness to practise - equality monitoring data
How we use personal data in education and quality assurance
How we use personal data in the Dental Complaints Service (DCS)
How we use personal data for statistical analyses and research
How we use personal data in consultations
How we use personal data for employment purposes
How we use personal data when you apply to work with us
How we use personal data in connection with Whistleblowing
Specific data sharing requests from third parties
How we use Closed-Circuit Television (CCTV)
How we use your personal data when you contact the GDC
Our Customer Services team manages most of the communication we receive. This includes calls made to 020 7167 6000, emails sent to us and most web forms sent to us.
There are two web forms managed by other teams. These are the ‘Complaint – about a dental professional’ webform, which is managed by our fitness to practise team, and ‘Dental Complaints Service – resolution service for private dental treatment complaints’ webform, which is managed by the Dental Complaints Service.
We will collect different information from you, depending on the type of communication you have with us. For example, if you are a registered dental professional or are applying to join one of our registers, it is likely that we will need to ask for personal data to assist with your enquiry. If you are raising a concern about a registered dental professional, we may need to collect personal data to investigate your concerns.
General enquiries, such as, checking a dental professional’s registration, should not require the collection of personal data.
Phone calls
Like many other organisations, we record and may monitor our telephone calls for quality improvement, training, compliance and security purposes. We record calls using a secure third party application.
All calls received into Customer Services and the Dental Complaints Service are recorded and retained for a period of six months. In addition, we record details of all calls received for reporting purposes.
Calls are sometimes retrieved and monitored for the following purposes:
- It is necessary to investigate a complaint.
- There is a threat to the health and safety of staff or visitors
- For the prevention or detection of crime.
- We need to check compliance with regulatory procedures.
- · They are required for legal proceedings.
- It is necessary in order to respond to a data subject rights request.
- It is part of a ‘spot check’ to ensure that our customer service standards are being met.
- To improve standards in call handling through training and coaching of our staff. In this instance the call will be edited to ensure the callers details are anonymised. The staff member will also need to agree to the call being used in this way.
All calls that are used for quality monitoring are retained.
Emails
All emails relating to a fitness to practise case, registration, or an enquiry from a member of the public that are sent to us are stored on our Customer Relationship Management (CRM) system.
All other emails received by the GDC are retained on our email system for a period of twelve months (plus a 28-days period for deletion) before they are automatically deleted.
Web forms
All web forms we receive are stored in our CRM.
Letters
All letters we receive are scanned and saved either into our CRM system or by the relevant team in their electronic files.
How we use personal data in Registration
Registration
Everyone who applies to join our register will be required to provide personal data to us. This may include special category data, for example, information about your health, and criminal offence data (including declaring a past criminal offence).
We use a third party service to verify the identity of applicants. This is to ensure we are certain that only the verified holders of the qualifications provided are admitted to the register.
We may need to contact referees, or other persons who are named by you in your application form or provided subsequently. This is to verify the information you provided or to obtain further information. Where you have declared any information about a health issue, we may need to obtain information from your doctor or other healthcare professional, involved in your care or treatment.
The registration application form includes equality monitoring questions, which are voluntary. Some of the information that we hold from this form is special category personal data (e.g. data about your racial or ethnic origin).
Overseas Registration Examination (ORE)
Some applicants for registration will be required to undertake the Overseas Registration Exam (ORE). This consists of Part 1 (a written exam) and Part 2 (a clinical exam).
People who sit the ORE are required to provide a character reference and clinical experiences references, and we will receive and store personal data about applicants from these referees.
The ORE application includes an equality monitoring form, which is voluntary for you to complete.
Dental professionals can also choose to complete the equality monitoring form on our online portal eGDC. Some of this equality information provided will be special category personal data (e.g. data about individuals’ racial or ethnic origin).
Part 1 and Part 2 of the ORE are administered by external providers under contract with the GDC, known as the Consortium.
We provide the Consortium with a list of the candidates sitting the ORE, together with information to enable them to identify candidates when they arrive to sit the exams. We also receive personal data from these external providers about candidates’ performance in the ORE. We may share equality monitoring data with the external providers, after the exam has taken place, to quality assure the exam.
Some applicants such as overseas qualified dentists and dental care professionals, will be required to undergo an assessment of their qualifications. Where this is the case, you will need to complete an application form.
We may obtain personal data about you from any character referees who have been named in your application, or from any health practitioners involved in treating you.
These applications are considered by our Registration Assessment Panel which are independent panels of dentally qualified assessors.
Where we process personal data, special category personal data or criminal offence data in connection with registration, we do it on the basis that the processing is necessary to carry out our statutory functions in relation to registration, and the processing is in the substantial public interest. In addition, some special category personal data is processed by us for the purpose of monitoring equality of opportunity or treatment.
In some cases, providing data to us for registration is a statutory requirement. Not providing data, or providing inaccurate data, may mean that your application for registration is refused or your applicant may be subject to fitness to practise procedures by us. This may lead to various outcomes, including conditions being imposed on your registration, the suspension of your registration, or removal (erasure) from the register.
How we use personal data in registration maintenance and sharing
Register Maintenance
Once you are successfully registered, we require that you undertake a retention process annually. The Annual Retention Fee (ARF) is the fee all registered dental professionals must pay each year to remain on the register.
We collect banking transaction and payment data for this purpose and contract with a direct debit collection service provider to manage the bulk processing of direct debit payments.
We will confirm and update personal information, collect indemnity declarations and continuing professional development (CPD) as part of the renewal process.
We use external providers and applications to send out the emails, letters and texts that support our renewal and registration communications.
Our online portal, eGDC-uk.org allows you to maintain your registration with the GDC. This website uses cookies to record personal information changes, banking and transaction information, IP address and online activity data from the website for security purposes.
Sharing register data
We may share our register information with the NHS and other healthcare bodies in the UK. A list of monthly removals is also shared with the NHS to alert them of the people we have removed from the register.
Working pattern data
We ask dental professionals to complete a small number of questions about their working patterns as part of their annual renewal process. These questions are voluntary, and you can choose not to answer these if you prefer. You will hear about this as part of our Annual Retention Fee communications.
We’re doing this as we believe having a better understanding of how dental professionals are working throughout the UK will provide important insight into the issues affecting dental professionals and patients.
This insight will help the profession develop future services that will bring about the changes the profession and patients want and need.
We collect this information for the purposes of undertaking analysis and producing and sharing reports about working patterns in dentistry and how it changes over time.
We will use the responses we receive to undertake analyses, produce reports and make data available to external organisations and stakeholders.
The responses we receive will help us and others to better understand:
- Where dental professionals are working.
- What dental professionals are doing.
- The number of hours they are working.
- Whether they are working in NHS or private practice.
- How the way dental professionals are working changes over time.
Our working pattern survey will ask registrants for the postcode of their primary place of work. This will be used to assist in our reporting of working pattern data, and to create reports based on more accurate place of work location data.
When you enter your work postcode, the lookup will include a full address for you to select. However, only the postcode itself, not the full address, will be visible to and retained in the GDC database for your response to this question.
Working pattern data will be used alongside other information we hold, including registrant equality, diversity and inclusion data, to better meet this purpose.
We will only share and report datasets in a format where no individual is directly identifiable and only following approval under our report request process.
We will ensure that no individual can be identified when we publish reports based on this data.
Working pattern data, including postcode, will not be used to make decisions about fitness to practise cases, your registration, or your annual renewal nor will they affect your access to GDC services or how we treat you.
The responses you provide are your personal data but will only be viewable by specific GDC staff who technically manage our data and systems and undertake data analysis. The datasets do not include directly identifiable information such as names.
Under data protection law, the basis we use to process this information is our ‘legitimate interests’. This means we have judged it ‘necessary’ for us to use personal data to meet the purposes we have for this work.
When we process special category data, such as some equality, diversity and inclusion information for this purpose, we do so as it is necessary for our public task and necessary for reasons of substantial public interest.
This is because we are uniquely placed to contact dental professionals wherever they work. The objective of this work is to support the wider public benefit from analysis and sharing of information with sector stakeholders such as NHS organisations.
This will facilitate a better understanding of how dental professionals are working throughout the UK and will provide important insight into the issues affecting dental professionals and patients. These interests support our statutory function of protecting the public.How we use personal data in fitness to practise – initial assessment, assessment and investigation
We have a statutory responsibility to investigate whether the fitness to practise (FtP) of a dental professional who is registered with us is impaired. Where FtP is impaired, this may lead to various outcomes, including conditions imposed on a dental professional’s registration, the suspension of that registration, or erasure from the register.
We have statutory powers that allows us to obtain information as part of our fitness to practise investigations, and we may exercise these powers to help us investigate these issues.
- Registered dental professionals
- Informants (including people who have raised concerns with us about a dental professional)
- Patients (e.g. people who have been treated by the dental professional but who are not themselves informants).
- Witnesses (those who are able to provide information in relation to the conduct but did not raise concerns with us directly)
- Colleagues / Employees / Employers of the relevant dental professional.
This may include special category personal data (e.g. health). It may also include criminal offence data (e.g. where a FtP issue arises as a result of a criminal offence).
We may also need to disclose the identity of the informant to the dental professional. If an informant requests that they are kept anonymous in an investigation, then we will try to respect this.
However, if it appears there is need to disclose, i.e. it appears it is not possible for a case to be progressed without disclosing the identity of the informant and we consider that we must progress the matter in order to meet our statutory objectives which include protection of the public, or because there is otherwise a legal obligation to do so then we may disclose the identity of the informant even if they have asked us not to. If we consider that we are required to do this, we will inform the informant beforehand, and they will be able to raise any concerns they have with disclosure.
It is possible that a dental professional may be able to identify the informant from the nature of the concerns raised, even if the informant is not named by FtP.
More information about the disclosure and publication of information during the fitness to practise process can be found in our Disclosure and Publication Policy.
Where the FtP investigation relates to clinical matters, we may need access to the medical or dental records of the informant or other relevant people. We may also need information about the health and wellbeing of the dental professional, informants, or other relevant individuals such as other patients treated by the dental professional.
Concerns can be raised by sending us a web form, email or letter.
We can also raise a concern directly through our In-house Legal Presentation Service (ILPS) or Dental Complaint Service (DCS).
Initial assessment, assessment and investigation
The concerns received will initially be considered by our Initial Assessment team, to determine whether they should go forward to be considered at the assessment stage.
When cases are referred to the casework stage, the caseworker will obtain the information necessary to complete their investigation. This may include sharing relevant information with a clinical adviser for comment. Where the concerns raised relate to a dental professional’s health, we may need access their medical records, and contact their GP or other medical practitioners.
It may also be necessary for the dental professional to have a health assessment and for information to be shared with our contracted Occupational Health providers for that purpose. As part of this assessment, we may ask for hair and blood samples, for the purpose of alcohol or drugs testing.
Once the caseworker has completed their investigation, they will review the matter and will conclude that either:
The information received does not mean we can raise an allegation that the dental professionals’ fitness to practise may be impaired, and will close the case; or
The information received does mean we can raise an allegation that the dental professionals’ fitness to practise may be impaired and will refer the case to our case examiners.
Case examiners are dental professionals or lay people but are also GDC staff who have a statutory duty to make decisions at the conclusion of an investigation. The evidence is considered by two case examiners (one lay and one a dentist or dental care professional) who review the evidence obtained during our investigation, including any evidence provided by the dental professional or their representatives and the informant.
Case examiners don’t make findings of fact in a case or come to substantive conclusions regarding a dental professional’s fitness to practise. They do determine whether an allegation should be considered by a Practice Committee. They can also close a case or impose conditions on the dental professional.
How we use personal data in fitness to practise - prosecution and hearings
Prosecution
When a Fitness to Practise (FtP) case is referred by the case examiners to be heard by one of our Practice Committees, the In-house Legal Prosecutions Service (ILPS) will take responsibility for conducting the case before the Committee on behalf of the GDC. The ILPS also conducts cases where we are seeking an Interim Order and Review cases before our respective Practice Committees.
The ILPS may need to share information with witnesses, including expert witnesses, for this purpose. In some instances, we may ask our External Legal Prosecution Service (ELPS), a third-party law firm contracted to carry out this work for us.
It may be necessary for the dental professional to have a health assessment and for information to be shared with our contracted service provider for that purpose. As part of this assessment, hair and blood samples may be taken.
Hearings
Hearings held before our committees are managed by our Dental Professionals Hearings Service.
You can review the Privacy notice of our hearings service on the Dental Professionals Hearings Service website.
How we use personal data in connection with illegal practice
It is a criminal offence for someone who is not a registered dentist or dental care professional to practise dentistry, or to say that they practise dentistry. It is also a criminal offence to use a protected dental title or to unlawfully carry on in the business of dentistry as an individual or body corporate.
We will investigate and prosecute these offences or take other appropriate enforcement action.
We collect personal data from anyone who complains to us about illegal dental practice. This may include witness statements provided to us and medical records of any informants.
As part of our review, we will collect personal data about the people we investigate to ascertain whether they are practising dentistry illegally. This may include data obtained through publicly available information or because of our investigations.
If the matter proceeds to Court, we are required to disclose material to the defendant. This may include details of the initial complaint we received. If the informant did not assist us in our investigation, these details will be provided in redacted form without disclosing the informant’s identity.
Where we process personal data, special category personal data or criminal offence data in connection with illegal practice, we do so on the basis that the processing is necessary to exercise our statutory functions in relation to illegal practice and is in the substantial public interest.
Failure to provide information to us in connection with illegal practice may prejudice the success of a prosecution brought by us. In the case of a registered dental professional, failure to provide information or the provision of inaccurate information may lead to FtP proceedings.
How we use personal data in fitness to practise – equality monitoring data
We have a duty to work to eliminate discrimination, harassment and victimisation. That means advancing equality of opportunity and fostering good relations between those who share relevant protected characteristics and those who do not. These requirements are set out in the Public Sector Equality Duty.
To help us to identify issues and monitor our progress, we ask those who raise public protection issues or concerns with us to complete an equality monitoring form. The form is a multiple choice questionnaire which asks about your sex, gender, whether you consider yourself to have a disability, any legal marital or registered civil partnership, your religion, sexual orientation and ethnic group. Every question includes a ‘prefer not to say’ option.
The personal data we collect using the equality monitoring form is allocated a unique identification number and stored on our Customer Relationship Management system.
That data record is linked to your contact information. It is only available to those who need to access it for the purposes of data analysis, monitoring and reporting. It is not available to, or used by, fitness to practise caseworkers or decision-makers.
How we use personal data in education and quality assurance
We have a statutory responsibility to monitor the quality of education and training programmes in the UK that lead to registration as a dentist or a dental care professional. To achieve this responsibility, we carry out quality assurance of these programmes. This work is carried out by education associates working for us.
Before an inspection, we will normally have access to the CV’s of staff members from the education provider. During the inspections, our inspectors will meet staff members and students and will take notes of these meetings. Our inspectors may ask to see a copy of student log books which contain details of the clinical work that students have carried out.
All student and patient data sent to us is anonymised. Any information that cannot be anonymised is only viewed in person and no details are recorded. Our inspectors may also see student exam results (anonymised) and progress reports and student FtP data (not anonymised).
Inspectors contribute to the preparation of a final report which is shared with the education provider. In this report, staff and student names are anonymised, and staff roles and gender are not disclosed to avoid identification.
On occasion, students will contact our’ education and quality assurance team with a complaint about their education provider. The complaint will be investigated if the student agrees that it should be investigated or if we consider that the nature of the complaint requires investigation even without the student’s agreement.
Where we process personal data, special category personal data or criminal offence data in connection with quality assurance, we do so on the basis that the processing is necessary to complete ’our statutory functions in relation to dental education and is in the substantial public interest.
If a registered dental professional fails to provide information to us in connection with quality assurance, or provide inaccurate information, it may lead to fitness to practise proceedings.
How we use personal data in the Dental Complaints Service (DCS)
The DCS was set up by the GDC to assist dental patients and dental professionals in resolving complaints about private dental treatment.
It is a resolution service, where the final stage is a panel meeting. The panel comprises of two lay and a clinical member who make recommendations to resolve disputes. More detailed information about their process including how they use and share information with the GDC is available on the DCS website.
Patients who are in dispute with a dental professional are not obliged to use the DCS route in order to resolve the complaint. Neither patients nor dental professionals are obliged to follow the panel’s recommendations as to how their dispute should be resolved.
The DCS process involves the processing of personal data about both patients and dental professionals. This may include special category personal data, or criminal offence data. Information held and used by the DCS will include:
- Patient contact details, addresses, contact numbers, emails, dates of birth etc.
- Dental professional’s contact details.
- Dental records.
- Correspondence relating to dental complaints.
- Panellist information.
- Anonymised equality and diversity information.
- Recordings of calls to the DCS helpline for training and quality monitoring purposes.
Anonymised case studies are developed from real life case examples to assist in learning and development of DCS staff.
We process dental professionals’ personal data in connection with the DCS as it is necessary to carry out our statutory functions.
Where we process dental professionals’ special category personal data or criminal offence data in connection with the DCS, we do so because it is necessary in delivering our statutory functions and is in the substantial public interest.
Patients are not obliged to make use of the DCS. However, where a patient decides to make use of the service, the dental professional is obliged to engage in the process which includes providing information. Failure to do so may lead to fitness to practise proceedings.
How we use personal data for statistical analyses and research
The personal data which we use to carry out our regulatory functions is used for statistical analyses and research. Personal data includes demographic information, employment, and data generated during the fitness to practise process.
We conduct data analyses, commission and support research on a range of topics to provide evidence that informs our approach to regulatory functions related to registration, fitness to practise, and education and training.
We process personal data in carrying out research on our own behalf on the basis that it is necessary to exercise our statutory functions and is carried out in the public interest. Where the processing includes special category data, it is also on the basis that it is necessary for research purposes.
As part of data analyses and research, we use personal data including special category and protected characteristics to help us understand more about a range of issues and their impact on dental professionals across everything we do. We do this to help ensure we are not discriminating against anyone and being fair.
Statistical analysis of personal data or research are never used to make decisions about a dental professional’s registration or about a fitness to practise case.
We share personal data with researchers working on our behalf if it is necessary to do so. We do so under contract and ensure we have adequate safeguards in place, only sharing what is necessary for the research, using secure methods. When we commission research to contractors or provide support to external research not commissioned by GDC, we default to providing them with anonymised data.
When we publish research or statistics, we ensure individuals cannot be identified from reports. We will never identify individuals in published data analyses or research without first gaining consent from those involved.
In some circumstances we want to use non-anonymised data. These requests for internal or external use are carried out under our report request process, which includes advice from our Data Protection Officer. Decisions to allow these data uses are made by the relevant Executive Director and if needed the Chief Executive and Registrar.
Third Party Research
As well as conducting our own research, we co-operate with third party organisations that are conducting their own research. We default to sharing anonymised or pseudonymised data (where a unique reference is used instead of personal data). Sometimes we share non-anonymised personal data with third parties.
Third party research will typically support our regulatory functions, for example registration, fitness to practise, and education and training.
We share data with third party organisations conducting their own research on the basis that it is carried out in the public interest. Where the processing includes special category data, it is also on the basis that it is necessary for research purposes.
Where we share data with third party researchers, we do so under appropriate agreements and ensure we have adequate safeguards in place, only sharing what is necessary for the research, using secure methods. These are considered under our report request process.
How we use personal data in consultations
A public consultation is any exercise where we are seeking agreement or views on a set of proposals to amend policies, procedures, rules, or guidance.
When exercising our regulatory functions, we must have proper regard for the interests of the public and patients, and dental professionals. In some circumstances, we have a statutory duty to consult if we are proposing changes to fitness to practise rules.
A consultation is normally a formal, timebound and public process, where our proposals are set out and explained in full. Public consultations typically invite responses from dental professionals, the public and patients, and other stakeholders. That can be done by asking for responses to specific questions or simply inviting comments on the proposals. Public consultations tend to be done in writing, but can include engagement activities, such as facilitated focus groups, stakeholder meetings etc.
Personal data is often collected or created as part of a consultation exercise. The processing and sharing is necessary for us to perform a task in the public interest or to meet our statutory duties. Your information will be shared with relevant GDC staff members, and may be shared with GDC Council members.
The information you provide, will be used to:
- Clarify any issues raised by the respondent.
- Assess the potential impacts of the proposed changes.
- Analyse the views of respondents.
Providing personal data as part of a public consultation means you understand it will be used for the purposes set out above. If you do not wish it to be used in this way, you should limit any personal data you provide, or remove it completely.
An anonymised summary of consultation respondents and the responses received will be included in a consultation outcome report. Consultation outcome reports are published in the consultations and responses section of our website.
All information contained in consultation responses, including personal data, can be subject to potential disclosure if requested under the Freedom of Information Act 2000. Personal data will not be published if doing so would breach data protection laws.
How we use personal data for employment purposes
We hold personal data about people who apply to work for us, work for us and who previously worked for us. This may include special category personal data (e.g. about health) and criminal offence data.
For recruitment purposes, we use an applicant tracking system to collect, store and manage recruitment documentation. This is managed by an independent provider. When candidates apply, their personal data in connection with the application will be stored in the site. This includes information provided by unsuccessful applicants.
All new employees are required to provide various items of personal data. This includes data about health, copies of passports, evidence of the right to work, and an equality and diversity form.
Where employees are unfit to attend work, they are required to advise their line manager, who will then update the absence on our HR system. This information will be made available to our People Services team.
Employees may be referred to the external Occupational Health provider; and, with the consent of the employee, we may receive copies of an individual's occupational health report. Once shared it will be stored on the employee record and will be held in accordance with GDC retention schedules.
Performance reviews are usually conducted by an employee's line manager. Statements from the employee and their manager about performance are entered and stored on our HR system. Information about performance reviews may also be held by the line manager and/or by People Services.
Information about an individual's disciplinary record will be held by People Services.
For high-risk grievance cases, we may consult an expert third party. Once the investigation is complete, all data will be deleted from their systems.
People Services may prepare reports on matters such as absence and performance, to present to the management team. Such reports will be anonymised, so they do not contain personal data.
All employees are required to provide regular and considered declarations of any conflicts, or perceived conflicts of interest. To promote transparency, and public confidence in the organisation and the regulatory process, we publish the declarations of the Executive team and our Case Examiners on our website.
We hold Council Meetings several times a year. These meetings can be attended by members of the public as observers and are live streamed. The focus of the live stream is on Council Members, however internal presenters and other employees observing may be visible on the stream. We do not keep recordings of these streams. The personal data processed on these streams in done so as part of our Public Task.
We process personal data in connection with employment that is under the basis that it is necessary for the exercise the various statutory functions conferred on us.
Where we process special category personal data or criminal offence data in connection with employment, we do so on one or more of the following bases:
The processing is necessary for the exercise of our statutory functions and is also in the substantial public interest.
The processing is necessary to perform or exercise our legal obligations and rights in connection with employment.
The processing is necessary for health purposes (including occupational health or the assessment of an employee's working capacity).
Some special category personal data is processed by us in the context of employment, for the purpose of monitoring equality of opportunity or treatment. It is optional to provide this information and is collected and processed only with the consent of the employee.
How we use personal data from GDC associates
We work with associates who provide expert advisory, investigatory or adjudicatory services to support us in carrying out our regulatory functions.
These associates perform roles such as Fitness to Practice Panel Members or Advisers, Registration Appeal Panel Members, Overseas Registration External Examiners, Education Inspectors, Clinical Advisers, Expert Witnesses, Dental Complaints Service Panellists, Specialist List Appeals Panellists, Council members and members of other statutory and standing committees.
We hold personal data about people who apply to be associates, and about our current or former associates. This may include special category personal data (e.g. health) and criminal offence data.
We collect, store and manage information related to the recruitment of our associates. This site is managed by an independent provider. When candidates apply to work at the GDC, their personal data in connection with the application is stored. This includes information provided by unsuccessful applicants.
For associates who provide services to FTP as Clinical Advisers or Experts, we will retain a list of expertise which will detail their registration number, name, contact details, specialties, and length of experience. The associates’ details are retained on the list for as long as they are an active associate with the GDC.
In addition, we process some special category personal data about associates for the purpose of monitoring equality of opportunity or treatment. Proving this information is optional, and its collected and processed only with your consent.
Information about the quality of an associate's work for us is held by the line manager and may also be shared with people Services.
Associates are required to provide regular and considered declarations of any conflicts, or perceived conflicts of interest. To promote transparency, and public confidence we publish these declarations.
We process personal data about associates as it is necessary to allow us to exercise the various statutory functions we carry out.
The data is used to verify an associate's identity and work rights, to enable performance of the contract for services between the parties (including communication, payment of fees and reimbursement of expenses, if applicable), and to monitor and provide feedback on work quality.
Where we process special category personal data or criminal offence data about associates, then we do so on one or more of the following bases:
- It’s necessary to allow us to exercise our statutory functions and is also in the public interest.
- It’s necessary for allow us to exercise our legal obligations and rights regarding any contract for services with the associate.
- It’s necessary for health purposes (including occupational health or the assessment of an associate's working capacity).
How we use personal data when you apply to work with us
Your data will be held in in confidential files held by our People Services team. Your data will be shared with the hiring manager, other selection panel members and senior managers who are involved in the decision making process. Your information will be held on file for a maximum of 12 months.
How we use personal data in connection with Whistleblowing
We may need to use and share information you give us with other organisations, such as government departments, enforcement agencies and the police, for the purpose of investigating the issues raised. There may also be certain circumstances where we are
required, by law, to share your information.
Specific data sharing requests from third parties
- in relation to legal proceedings
- in response to requests from law enforcement agencies
- in response to requests from other regulators.
We may also share information with law enforcement agencies, other regulators, or other appropriate bodies when it is necessary for either their, or our, statutory or public functions or legitimate interests. [KS1]
The data shared in these situations will be limited to what we are satisfied is necessary and lawful for the stated purpose.
We are obliged to share personal and special category data with the Professional Standards Authority. We do so with an Independent Controller Agreement in place and with due regard to security of data. Their access to the data is revoked once no longer needed.How we use Closed-Circuit Television (CCTV)
CCTV is in operation at our offices. Where we are not the sole occupier of the building (Colmore Square) there is additional CCTV which is controlled by the building owners or management company.
We record CCTV images of people who enter and leave our premises as well as at other locations throughout the buildings. This is for the purposes of security and safety monitoring and the investigation of alleged criminal offences. We may share our CCTV images with law enforcement and courts if this is needed.
We use our premises to perform our regulatory functions. We consider that ensuring the security and safety of our premises is necessary to perform a task carried out in the public interest and/or in our official authority as a regulator.
The GDC’s websites
The GDC operates the following websites:
Our privacy policies apply to our websites only. If you follow a link to an external website, you will be subject to that organisation’s privacy policies, not the GDC’s.
Cookies
Cookies are small text files that are placed on your computer or phone by websites that you visit.
We use cookies to collect and store information about how you use GDC websites, such as the pages you visit. This information is anonymised. It cannot be used to identify you personally.
Read more about the cookies we use.
Personal information we collect about you
You can use our websites without disclosing any information which identifies you as an individual.
If you enter personal details into a form, the GDC will use your information to provide the service you have requested.
Special category of personal data
Some personal data processed by us is special category data or criminal conviction data.
Read our Guidance on Reporting Matters to the GDC.
More information about how we comply with data protection law (as set out in the UK GDPR and in DPA 2018) in relation to special category data is set out in the GDC’s Data Protection Policy and Appropriate Policy Document.
Sharing personal data to third countries
However, in the course of communicating with Registrants resident in third countries, it is necessary that their data be shared back with them. Moreover, payments made by them will be processed by our third party provider to the territory in which they reside.
Attending Council Meetings as an observer
Members of the public who wish to attend Council Meetings as an observer are able to submit their request via our Webform. Observers can join virtually or in person.
We only collect personal data of those who view the stream through the webform, we do not collect data using our stream provider.
While the video feed for the stream is focused on Council Members it is possible that observers may be visible on the stream. We do not keep recordings of these streams.
Period of retention
We keep anonymised data about how our websites are used for 14 months.
Our Retention schedule sets out the length of time we keep personal data.
Your rights
You have the right to see any personal data that we hold about you.
See our Data Subjects Rights Policy for more information about how we protect your rights in the UK GDPR. This policy also explains how we process requests for correction, or erasure, or objections to processing.
In summary you can:
- Ask for access to any personal data we hold about you.
- Ask for personal data we hold about you to be erased.
- Ask us to restrict the processing of your personal data, so that it can only be used for limited purposes (set out under UK GDPR).
- Object to the processing of your personal data.
- Ask for personal data to be provided in a structured, commonly used and machine-readable format, that allows you to send it to another data controller.
- Withdraw your consent where we process your personal data on the basis of consent.
Find out more about your rights on the Information Commissioner's office website.
The GDC’s Data Protection Officer
If you have any questions or concerns about how the GDC is using and sharing your personal data, then you can contact our Data Protection Officer by emailing: [email protected].