Privacy notice
This Privacy Notice explains how the HTA collects, uses, retains and discloses personal information and how you can exercise your information rights.
In addition to this, the privacy notice demonstrates how the HTA is committed to protecting and respecting your privacy.
For further information on how we use your information, from the menu below please click on the relevant drop-down heading.
Who we are and what we do
Who we are and what we do
The Human Tissue Authority (HTA) is the regulator of human tissues and organs. We are a non-departmental public body of the Department of Health and Social Care. The HTA regulate licensed establishments via an Independent Assessor (IA).
The HTA is a ‘Data Controller’ under the Data Protection Act (DPA) 2018. This means the HTA is responsible and is held accountable for processing your personal data in line with data protection legislation.
Data protection legislation
Data protection legislation
The HTA whilst processing your personal information must comply with the following legislation:
- The Data Protection Act (DPA) 2018
- UK General Data Protection Regulations (UK GDPR)
- The Human Rights Act 1998 (HRA)
- The Common Law Duty of Confidentiality
Where required, the HTA will satisfy the common law duty of confidentiality. The key principle of this is, that information confided should not be used or disclosed further, except as originally understood by the confider. Unless:
- We obtain your valid consent to disclose further
- If the information is required by law or ordered by a court
- There is an overriding public interest to disclose.
We will define a lawful basis for the disclosure of the personal information that has been provided in confidence.
Together these Data Protection laws give you more rights as an individual and place greater obligations on those controlling and processing your personal data for any purpose.
Data protection principles
There are seven key principles at the heart of the Data Protection Act 2018 and these form the basis upon which we will process your personal data. The principles are:
Lawfulness, fairness and transparency
Purpose limitation
Data minimisation
Accuracy
Storage limitation
Integrity and confidentiality(security)
Accountability
You can read more about the data protection principles on the Information Commissioner’s Office (ICO) website. A guide to the data protection principles | ICO
The HTA’s legal framework
The HTA’s legal framework
The legislation listed below along with the HTA’s Codes of Practice and standards forms the basis of our regulation:
The Human Tissue Act 2004 and associated Regulations
Human Tissue (Scotland) Act 2006 In accordance with the powers in Section 54, under the Human Organ and Tissue Live Transplants (Scotland) Regulations 2006, the HTA make decisions on all living organ donation transplants taking place in Scotland on behalf of Scottish Ministers.
These laws ensure human tissue is used safely, ethically and with valid consent. Consent is a fundamental principle of the legislation.
Lawful basis for processing your personal data
Lawful basis for processing your personal data
Paragraph 7 of Chapter 2, within Part 2, to the Data Protection Act 2018 says that, as a government body, the HTA may process personal data as necessary for the effective performance of a task carried out in the public interest.
We will always identify the lawful basis on which your personal information is processed as defined by Article 6 and 9 of the UK GDPR. Please see the individual sections for the purposes of processing personal data throughout this privacy notice which identity the legal basis for processing.
'The HTA's legal framework’ section provides the list of legislation and Codes of practice to which we comply.
Your information rights including subject access requests
Your information rights including subject access requests
Under data protection legislation you have a number of rights regarding how your personal data is processed:
The right to be informed: With regards to the collection and use of your personal data you have the right to request what information the HTA holds about you.
The right of access: More commonly known as a Subject Access Request (SAR), you have the right to have access to your personal data and to request a copy including supplementary information.
The right to rectification: If the personal data we hold about you is inaccurate or incomplete you are entitled to have it rectified under reasonable circumstances.
The right to erasure: This is not an absolute right and only applies in certain circumstances.
The right to restrict processing: We can continue to store your personal data but not process it any further. This will only apply in certain circumstances.
The right to data portability: This allows us to move, copy, transfer personal data easily in a safe and secure way and without hinderance.
The right to object: Allows you to object to the processing of your personal data, exceptions and limitations apply.
The right to withdraw consent: If you have provided consent for the HTA to process your personal data.
Rights in relation to automated decision making and profiling: The HTA does not use automated decision-making as standard practice.
Under the Data Protection Act 2018, the HTA has a calendar month to respond to your request. If you wish to exercise your rights, please contact the HTA either by
Email: dataprotectionofficer@hta.gov.uk or
Post: Human Tissue Authority
2nd floor, 2 Redman Place
Stratford, London
E20 1JQ
In addition to the above individual information rights, you also have the right to contact the Information Commissioners Office (ICO) if you feel your personal data has not been processed fairly or within the confines of data protection legislation.
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk
National Data Opt-Out Policy
National Data Opt-Out Policy
The National Data Opt-Out policy allows individuals to opt-out of having their confidential patient information shared for purposes beyond their direct care. The HTA must consider national data opt-outs when processing data for purposes beyond individual care in line with the wider policy. The National Data Opt-Out policy does not apply for disclosure of information relating to living organ donation decisions and serious adverse events and reactions notifications. For further information see National Data Opt-Out - NHS England Digital
Purposes for processing your information
Purposes for processing your information
We need to process personal information about you so that we can perform our regulatory functions.
Please see the individual sections within this privacy notice which provide the HTA’s purposes of processing personal data, the data processed and the legal basis which allows us to process this information.
- Licence contacts
- Organ Donation and Transplantation
- The Duty to Report
- Bone Marrow and Peripheral Blood Stem Cell (PBSC) donations
- Job applicants
- Newsletter subscribers
- General enquiries
Licence contacts
Licence contacts
The HTA’s legal framework creates a requirement for four primary roles to exist at the establishments that we license. Those roles are:
Designated Individuals (DI)
Named Contacts (in the Organ Donation and Transplantation sector only)
Persons Designated (PD)
Licence Holders and Licence Applicants (either an individual or the person acting on behalf of a corporate body)
For the people in these roles, we process information including:
Contact details
Job title
Name and address of the establishment where you work
Gender
Previous names
In the case of DIs and Licence Holders, we additionally process information supporting your suitability for those roles. This information includes:
Educational or professional qualifications
Membership of relevant professional bodies
Details of your other relevant experience
Your own assessment of your suitability for the role
Our legal basis for processing this personal information is:
- UK GDPR Article 6 (1) e. The exercise of our official authority laid down by our legal framework.
Organ Donation and Transplantation
Organ Donation and Transplantation
The HTA regulates the donation of organs in the UK from living people by making the decision on whether the donation can go ahead, based on criteria set out in law.
The HTA’s role is to provide an independent check to help protect the interests of living organ donors. They ensure each individual donor has an opportunity to speak freely to someone not connected with the transplant unit in order to confirm that:
the donor has the capacity to make an informed decision
there has been no reward sought or offered for the organ donation
their wish to donate is free from any pressure to act against their will
they understand the nature of the procedure and risks of the surgery.
An Independent Assessor (IA) trained and accredited by HTA will carry this out. IAs undertake interviews with donors and recipients to explore whether the conditions set out above have been met. IAs do not determine the medicals suitability of the donor or recipient.
The HTA uses the report of the IA, and any other information gathered as part of its consideration of the case, to make the decision on whether or not to approve the proposed donation.
In order for this decision-making process to work we will process the personal data of a number of different types of people.
For the clinicians and other professionals working in transplant teams we process information including:
Contact details
Job title
Name and address of the establishment where you work
Gender
Previous names
For Independent Assessors we process information including:
Contact details
Name and address
Gender
Previous names
Referee contact details
Any references provided
DBS certificate number
Our legal basis for processing this personal information is:
UK GDPR Article 6 (1) e. The exercise of our official authority laid down by our legal framework.
Our legal basis for processing the special category data
UK GDPR Article 9 (2) h. Processing is necessary for the provision of health care.
Our legal basis for processing criminal offence data, i.e. DBS information is:
DPA 2018 Schedule 1 Condition 2 Health or Social Care Purposes.
We will also process personal and special category data about donors and recipients of organs, including those adults who lack capacity and children who do not have competency to consent to the procedure. The precise data will differ on a case-by-case basis but will include:
Name
Date of birth
Address
NHS Number
Information which may identify your gender
Medical history which may include diagnoses
Your medical and clinical suitability to donate
Our legal basis for processing this personal information is:
UK GDPR Article 6 (1) e. To perform a task in the public interest or for the exercise of our official authority laid down by our legal framework.
Supply of Information about Transplants
Supply of Information about Transplants
The UK Government brought into force The Human Tissue Act 2004 (Supply of Information about Transplants) Regulations 2024, relying on powers in section 34 of the Human Tissue Act on 1 April 2024 and the Scottish Government brought into force The Human Tissue (Supply of Information about Transplants) (Scotland) Regulations 2025, under section 19 of the Human Tissue (Scotland) Act 2006, on 1 July 2025.
These Regulations place a statutory duty on relevant clinicians in England, Wales, Scotland and Northern Ireland. Relevant clinician means any of the following whether practising as such a clinician in a transplant centre or a non-transplant centre:
(a) a specialist nurse involved in living donor care
(b) a specialist nurse involved in recipient care
(c) a transplant surgeon
(d) a physician involved in living donor care, and
(e) a physician involved in recipient care.
The duty requires the relevant clinicians to report the following information to the HTA:
a. If they have a reasonable suspicion that an organ transplantation-related offence may have been committed or
b. If they are made aware that a patient has received an organ transplant outside the UK.
The HTA will consider information reported by clinicians under the Regulations in instances where it believes an offence may have been committed, the HTA will refer the case to the police.
Based on the information that clinicians are required to report, we will receive and process data about the reporting clinician. This includes their name, contact details, position and place of work. We will also receive and process personal and sensitive data about donors, potential donors, recipients, intended recipients and other person(s) who may have been involved in commissioning an organ donation and transplant-related offence. The data may include:
- Information about the individuals involved (including their name, date of birth, age, gender and countries of legal citizenship or residency)
- Medical history
- Medical and clinical suitability to donate or receive an organ.
Our legal basis for processing this personal information is:
- UK GDPR Article 6 (1) e. To perform a task in the public interest or for the exercise of our official authority laid down by our legal framework.
Our legal basis for processing criminal offence data is:
- UK GDPR Article 9 (2) g. It’s in the substantial public interest laid down by our legal framework; Section 34 of the Human Tissue Act 2004 and Section 19(1) of the Human Tissue (Scotland) Act 2006
- Schedule 1 DPA 2018 (10) Preventing or detecting unlawful acts, for example where an organ donation and transplant-related offence may have been committed.
Bone Marrow and Peripheral Blood Stem Cell (PBSC) donations
Bone Marrow and Peripheral Blood Stem Cell (PBSC) donations
The HTA is only responsible for giving approval for bone marrow and PBSC donations in cases where the donors are unable to consent for themselves.
In order for this decision-making process to work we will process the personal data of a number of different types of people.
For the clinicians and other professionals working in transplant teams we process information including:
Contact details
Job title
Name and address of the establishment where you work
Gender
Previous names
For Accredited Assessors we process information including:
Contact details
Job title
Name and address of the establishment where you work
Gender
Previous names
We will also process personal and special category data about donors and recipients of bone marrow or PBSC where they are an adult who lacks capacity or a child who does not have competency to consent to the procedure and the person consenting to the donation on the donor’s behalf. The precise data will differ on a case-by-case basis but will include:
Name
Date of birth
Address
NHS Number
Information which may identify your gender
Medical history which may include diagnoses
Your medical and clinical suitability to donate
Our legal basis for processing this personal information is:
UK GDPR Article 6 (1) e. The exercise of our official authority laid down by our legal framework.
Our legal basis for processing the special category data is:
UK GDPR Article 9 (2) h. Processing is necessary for the provision of health care or treatment.
Job applicants
Job applicants
Employee data is stored on an internal HR system and the HTA have a separate privacy notice for employees.
The HTA use multiple channels for recruitment purposes, and we encourage you to read the privacy notices wherever you encounter a HTA job advertised.
The HTA will receive a copy of the personal data and sensitive personal data for job applicants, including unsuccessful applicants. This data will include:
CV and personal statements
Contact details
Qualifications, licences and professional memberships
Employment history
Ethnicity, diversity and inclusion information
Sexual Orientation
Criminal Convictions
Disability details
Our legal basis for processing this information is: UK GDPR Article 6 (1) b. Contract.
- It is necessary for the performance of a contract to which you are a party – an employment contract.
- It is necessary in order to take steps at your request prior to entering into a contract for employment.
It is necessary to comply with a legal obligation placed on us as the data controller. We are required to report on equality of opportunity and onboarding processes have specific requirements.
Our legal basis for processing the special category data is:
- UK GDPR Article 9 (2) b. Employment.
We are required to do this by employment law relating to assessing your capacity to work, to monitor that equality law is being met through the recruitment process and to comply with any safeguarding laws relating to the role you are applying for.
Newsletter subscribers
Newsletter subscribers
When you subscribe to our newsletter, you provide your consent to receive this form of communication under the Privacy and Electronic Communications Regulations. It is our legitimate interest to process the personal data you provide in the subscription process. This data will not be processed for any other purpose than to send you our newsletter and you can unsubscribe at any time using the unsubscribe link included in every newsletter. When you unsubscribe, your personal data will be automatically removed from the newsletter distribution system.
We use MailChimp who are owned by Intuit, to provide this service and they process your personal data on our behalf. You can read the Intuit privacy notice here Global Privacy Statement | Intuit.
Intuit operate in the United States, so your information is transferred to, stored and processed in the United States. Intuit participate in and certify their compliance with the UK Extension to the EU-US Data Privacy Framework and you can view their certification here: - Data Privacy Framework.
General enquiries
General enquiries
The HTA has a statutory obligation to provide information to the public and professionals working in the sectors that we regulate. One of the ways we do this is by responding to enquiries. When you make an enquiry we will process your name, contact details and the nature of the enquiry. The nature of the enquiry may contain personal data and special category data if you provide that information to us.
Our legal basis for processing this information is:
- UK GDPR Article 6 (1) e. The exercise of our official authority laid down by our legal framework.
Our legal basis for processing your special category data is:
- UK GDPR Article 9 (2) g. Substantial public interest.
- Schedule 1 DPA 2018 (6) Statutory etc. and government purposes.
The processing is necessary to meet the necessary obligation to provide you with information.
How we look after your personal data
How we look after your personal data
The HTA values the personal information entrusted to us and we make sure that we abide by the law when we process it. We also:
Make sure that only those people who have a need to do so process personal data.
Encrypt data using a number of encryption algorithms including: FIPS 140-2; Common Criteria EAL2+; and Intel Advanced Encryption Standard-New Instructions (AES-NI)
Consider security and privacy at the outset of any new project where we are planning to hold or use personal information in new ways and continue to review existing systems to ensure they comply with new laws.
Train our staff in how to handle personal information, maintain proper oversight of our information assets and respond appropriately if information is not used or protected properly.
Use of a Third Party to Carry Out Penetration Testing
To ensure that our systems remain secure and resilient, we periodically commission independent cyber‑security specialists to conduct penetration testing. This helps us identify and address potential vulnerabilities in our digital services.
We use an approved third‑party provider to carry out this work. The provider may require limited access to our systems in order to complete the testing. Any access is strictly controlled, time‑limited, and carried out under a formal contract that requires the provider to maintain confidentiality, follow robust security measures, and comply with UK data protection law.
No personal data is accessed unless this is essential for the test, and where this is unavoidable, the provider is required to act only on our instructions and must delete any data immediately after completing the work. The results supplied to us are anonymised and used solely to strengthen the security and integrity of our systems.
Who we share your personal data with
Who we share your personal data with
We sometimes need to share the personal data we control with other organisations. Where this is necessary, we are required to comply with all aspects of Data Protection legislation. What follows is a description of the types of organisations we may need to share personal information we process for one or more reasons. Where necessary, required and within the law, we may share information with:
Employment and recruitment agencies
Current, past and prospective employers
Other Government Departments
Suppliers and service providers
Small Claims Court for Debt collection
Financial organisations
Devolved Government departments
Health and care organisations
Trade, employer associations and professional bodies
Other statutory law enforcement agencies and investigative bodies
Health, social and welfare advisers or practitioners
Survey and research organisations
Police forces and other law enforcement organisations
The Government Internal Audit Agency and other auditors as required
Regulators i.e. the ICO
How long we hold onto your data
How long we hold onto your data
Outside of specific exemptions under data protection legislation, your personal data will only be retained for as long as is necessary to meet the purpose it was collected. We will not destroy records which may be relevant to ongoing inquiries.
All records are destroyed confidentially once their retention period has been met and the HTA has made the decision that the records are no longer required. To determine appropriate retention periods for different types of data, we consult relevant laws and best practice guidance (e.g. National Archives)
Why we may delete your personal data
Why we may delete your personal data
The Human Tissue Authority (HTA) is committed to protecting your privacy and complying with data protection laws. We only process personal data when it is strictly necessary and within our regulatory remit.
If we receive personal information that is not required for our regulatory functions, we will delete it. This is because:
- We have no legal or regulatory basis to process it.
- To reduce risk and maintain compliance, as retaining unnecessary data would breach data protection principles
- We follow strict records management standards to minimise data and protect confidentiality.
This ensures your information is handled responsibly and securely. Please note that copies may remain on our backup servers for disaster recovery purposes. These backups are not routinely accessed and can only be retrieved through a controlled process involving our IT department, ensuring the data is not accessible for any operational use.
Contact details of our Data Protection Officer
Contact details of our Data Protection Officer
A Data Protection Officer (DPO) is a role required by current data protection laws for public bodies. DPO’s are responsible for overseeing data protection strategy and implementation to ensure compliance with data protection obligations.
For enquiries about data protection please email: dataprotectionofficer@hta.gov.uk
Contact details for the Information Commissioner's Office (ICO)
Contact details for the Information Commissioner's Office (ICO)
For independent advice about data protection, privacy and data sharing issues you can contact the independent Information Commissioner’s Office at:
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Tel: 0303 123 1113
Website: www.ico.org.uk