Why we use personal information during the coronavirus (COVID-19) pandemic

Your data is being used in different ways or in different settings during the response to COVID-19 so that we can better inform our decision making and protect the public in this rapidly evolving situation.

The fundamental reason for using your data is still so that we can fulfil our role as a health board, for the purposes of managing your healthcare and of managing the healthcare system. This overall privacy notice explains our role in full and your data protection and data rights are not affected by how we’re using your data during the response to COVID-19.

We want you to be aware of some additional activities we’re undertaking. We will update this page from time to time as appropriate. Please do get in touch if you have any questions or concerns or you wish to exercise any of your data rights by emailing nss.dataprotection@nhs.scot

We remain focused on the COVID-19 response at present, so we ask for your understanding if our response times are slower than normal or we cannot fulfil all of your request at present. We continue to take steps to safeguard your data including the use of rapid risk assessments when we change something and using information sharing, data processing or confidentiality agreements as needed.

We are supporting the Scottish Government, Public Health Scotland (PHS) and NHSScotland health boards in the response to COVID-19. If you wish to find out how personal and healthcare data is being used during the COVID-19 response please read the Scottish Government's Information Governance COVID-19 Privacy Statement.

We provide some additional detail on our activities below and we’ll update this information periodically as our response to COVID-19 progresses. In many of the activities mentioned below, NSS is a joint controller of the relevant data, alongside PHS. PHS also have their own Privacy Notice.

How data is being used during COVID-19

During the COVID-19 pandemic, we’re processing data to help us carry out tasks or functions which relate to:

  • shielding
  • testing
  • contact tracing

We believe that this processing is necessary for protecting public health, health care purposes, statistical purposes and performing a task in the public interest. It also ties into the tasks (or functions) that we carry out, as directed by the laws mentioned in the why we use personal information section.


With PHS, we are controllers of the list of ‘shielded’ citizens in Scotland.

What we’ve done

We’ve provided information governance support and advice in relation to the shielding data set and we’ve been responsible for sending out letters to the identified citizens.

We’ve also provided contact information on those shielded to other public bodies, such as local authorities, to help shielded citizens. We’ve also updated their GP and health board that they are on the list so they can provide appropriate support.

Data being used
  • name
  • address
  • GP name and practice
  • health board
  • your shielding category where applicable
  • Community Health Index (CHI) number


We’ve supported the testing programme in Scotland by being the collation point of all COVID-19 testing data. NSS is a joint data controller together with PHS and local health boards.

What we’ve done

We provide relevant data to local boards, for tracing and support purposes as well as providing management information to Scottish Government and boards. We use the testing data to inform you of your COVID-19 test result directly through the National Notification Scheme.

Data being used
  • name
  • address
  • CHI number
  • date of birth
  • where and when you were tested for COVID-19 – where it was a drive through test, we also hold the time and date of the test, and details of the laboratory that processed the test
  • your COVID-19 test result
  • mobile number or email address

Contact tracing

We’ve set up the National Contact Tracing Centre on behalf of PHS, which together with local health boards will support contact tracing in Scotland.

What we’ve done

We further use the test data to populate the Case Management System which supports contact tracing in Scotland.

Data being used
  • name
  • address
  • CHI number
  • contact details such as a mobile or landline number
  • gender
  • ethnicity
  • GP practice details
  • details of your COVID-19 test result
  • contact tracing information that you provide, such as who you’ve been in contact with and where you’ve been

Impact and policy assessments on our COVID-19 work

To be as transparent as possible, we're publishing the Data Protection Impact Assessments, System Security Policy Assessments and Equality Impact Assessments in relation to the COVID-19 response work we've been delivering on this page. Please note, these have been reviewed to remove any information that may be harmful to the organisation should this be released into the public domain. If you have trouble accessing these documents or would like them in a different format or language, please contact NSS.EqualityDiversity@nhs.scot

Simple tracing tool

National Notification Service (NNS) and test data

Case Management System (CMS)