UX Writing for Digital Services - Data protection

All new forms and services must protect personal data. A service will need a data protection impact assessment (DPIA) if it collects health data and any other identifier.

Examples of an identifier include:

• a PPS number
• name
• phone number
• any contact details

The data controller responsible for the form or service should create the DPIA. It should be easy to understand.

Services can contact their local Data Protection Officer (DPO) for advice about data protection.

Use of personal information

If you collect personal information, you need to provide information about this.

You can do this by including information or a section about ‘Your personal information’. This should explain that we need this information to provide the service the person needs or has requested. It should include a link to a privacy statement with information about how we process people’s personal data, their rights and how to contact us about data protection and their personal information. This is also known as a data protection information notice (DPIN).

The service can link to one of the following privacy statements, if the information being collected in the form is for the public and it is covered in one of them:

• HSE patients and service user's privacy notice
• HSE website privacy statement

If the information being collected is not covered in one of these, the service will need to create a privacy statement tailored to the specific form.

If the information being collected is from HSE staff, the service can link to the HSE privacy notice for staff.