NHS Diabetes Prevention Program (DPP) - for the purposes of Statistics and Statistical Research, under section 45 of the Statistics and Registration Services Act 2007 as amended by the Digital Economy Act 2017

Statutory purpose:

The Statistics Board requires an extract from the Diabetes Prevention Programme (DPP) Dataset held by NHS England, in order to carry out its functions in accordance with section 20 of the Statistics and Registration Service Act 2007 (SRSA). The legal gateway for this will be Section 45C of the SRSA 2007 (as inserted by section 80 of the Digital Economy Act 2017) which permits The Board to serve a Notice on a public authority requiring it to disclose information it holds in connection with its functions:

http://www.legislation.gov.uk/ukpga/2007/18/section/45C

To do so, the information so disclosed must be required by the Statistics Board for one or more of its functions as set out in the SRSA 2007 and the Census Act 1920. The Office for National Statistics (ONS), as executive arm of the Statistics Board, is described as the body exercising those functions and is Data Controller for the uses outlined in this agreement.

The SRSA (2007) states that the ONS’s objectives include ‘promoting and safeguarding the production and publication of official statistics that serve the public good, where serving public good includes informing the public about social and economic matters and assisting in the development and evaluation of public policy’. It also sets out the Board’s functions, which are the specifically referred to in section 45c of the amended SRSA. Notably they include, under section 20, that ONS ‘may produce and publish statistics relating to any matter relating to the United Kingdom or any part of it’. This includes the production of official statistics, experimental statistics and statistical research. Any use of the word research in this agreement is in this specific context, and does not imply otherwise.

Requirements made under section 45 must also be in line with a statistical statement of principles that has been approved by parliament:

https://www.gov.uk/government/publications/digital-economy-act-2017-part-5-codes-of-practice/statistics-statement-of-principles-and-code-of-practice-on-changes-to-data-systems

This states that ‘We will only seek access to data for the purposes of fulfilling one or more of our statutory functions, including to produce official statistics and undertake statistical research that meets identifiable user needs for the public good.’

The statement also sets out six principles to which ONS will adhere when requiring information under section 45; they state that ONS will:

• safeguard confidentiality

• be transparent about what data it is accessing and why

• ensure accessing the data is lawful and meet strict ethical standards

• ensure that accessing the data is in the public interest - for example that the data are fit for purpose for the statistical use which ONS intends

• ensure requiring that the data be supplied is proportionate – for example, ONS will have exhausted possible alternatives

• seek to collaborate with suppliers at all times

Using robust information governance processes, ONS has determined that the conditions associated with requiring data under section 45c of the amended SRSA have been met for the information in this data sharing agreement. This process included working closely with NHS England’s experts to help determine that the data would be fit for purpose to meet the proposed statistical purposes. This work guided ONS’s assessment against some of the principles underpinning its legal powers – for example whether sharing the data is in the public interest, and proportionate in terms of burden on the supplier. In addition, as part of its commitment to transparency, ONS will publish full details of the reasons for acquiring the information, and ONS notes that NHS England will also publish this data sharing agreement. In terms of public interest, it is worth noting that the benefits gained from the statistics enabled by this data share do not need to be specific to health and social care when data are flowing under section 45 of the SRSA, although for this particular project the benefits should meet such a test.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for all of the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds.

The following are some of the key mitigations ONS employs for the data protection risks identified:

• The technical and procedural protections of the ONS secure data environment

• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS

• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information

• Analysts will never seek to re-identify subjects and

• ONS is only interested in producing aggregate statistics for the public good

The data shared with ONS under this agreement will not be onwardly disseminated or shared, except as disclosure controlled aggregate statistics and/or analysis as aggregated data with small numbers suppressed, in line with the relevant disclosure rules for the dataset(s) from which the information was derived. Any exceptions to this would require additional NHS England approval. It would also require an appropriate alternative legal gateway, because section 45c of the SRSA as amended by the Digital Economy Act only enables data to be shared with ONS (not for example, other Government departments or academic researchers).

The rest of this section will set out the specific purposes for which ONS requires the dataset under this data sharing agreement.

In future, should ONS decide to put the dataset to new uses not explained below, the new use will be in line with ONS’s legally defined functions, and ONS will inform NHS England and enter into an amended Data Sharing Agreement before proceeding with that new purpose.

The statistics ONS produces are driven by user needs. Often these user needs come from Government departments who are seeking better evidence to inform decision making in an emerging or increasingly high priority policy area. During and since the pandemic, there has been an increase in economic inactivity – particularly due to ill health – and ONS are uniquely placed to produce statistics that will provide better evidence about what is happening. This includes the impact of health on labour market participation, and vice versa. The ONS intends to use the Data for its health and labour market statistical work programme. Stakeholders such as the Treasury, Cabinet Office, DWP and DHSC are interested in ONS producing such statistics, and ONS has initiated a programme of work to produce new statistics in response. Part of this work programme requires the acquisition, linkage and analysis of the diabetes prevention programme (DPP) data.

The DPP, also known as the Healthier You programme, identifies people at risk of developing type 2 diabetes and refers them onto a nine-month, evidence-based lifestyle change programme. Participants receive personalised support to manage their weight, eat more healthily and be more physically active – which together have been proven to reduce a person’s risk of developing type 2 diabetes. Research shows the Healthier You NHS Diabetes Prevention Programme has reduced new diagnoses of type 2 diabetes in England, saving thousands of people from the potentially serious consequences of the condition. It cuts the risk of developing type 2 diabetes by more than a third for people completing the programme.

DHSC and NHS England would also like to understand whether the programme impacts on the labour market participation of subjects, mediated by improved health status. ONS can produce statistics on this by combining the DPP data with other data it holds on employment and benefits – this will allow ONS to produce figures on changes in labour market participation for those who successfully completed the programme, vs a control group of people who did not complete the programme.

The other data that will be integrated with the DPP data to determine the labour market outcomes are the Benefits and Income Dataset (BIDS), which the Department for Work and Pensions share with ONS, and Pay As You Earn (PAYE) data which HMRC shares with ONS. In both cases, the data are shared with ONS under section 45A of the SRSA for the production of official statistics. And in both cases, these data are deidentified and linked to the ONS demographic index (a method to enable onward linking to other sources without the need for direct identifiers) before any integration with other data sources (including health data sources as per this agreement) occurs.

The following NHS England Data will also be accessed and integrated to enable ONS to fulfil the purpose outlined above:

- Diabetes Prevention Programme

- HES Admitted Patient Care

- HES Accident & Emergency

- HES Outpatients

- HES Critical Care

- Emergency Care Data Set

The level of Data will be identifiable – Linkage to other sources at a record level is a prerequisite to success for the proposed uses, and therefore identifiers are required; as a minimum, NHS number, but other identifiers such as date of birth will be included where available as these will help quality assure whether links made with other datasets based on NHS number matching are indeed the same subject.

ONS sought advice from NHS England analysts who work with the DPP dataset and have established that all variables collected by NHS England on the Diabetes Prevention Programme are required to fulfil the purpose outlined in this agreement. Data is required from the start of the collection of DPP to latest available at time of extraction.

ONS is the controller as the organisation responsible for ensuring that the Data will only be processed for the purpose described above. Although the health and labour market statistical work programme is currently sponsored by the Treasury, the Treasury will not carry out any controllership activities. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these Departments may provide advice, but will never access the data. ONS retains its independence to ultimately determine what statistics are produced and how they are presented and published. Data will be accessed by substantive employees of ONS who have the relevant security clearance.

The purpose and use of these datasets, has been approved by the independent National Statistics Data Ethics Advisory Committee (NS-DEC).

The lawful basis for processing personal data under UK GDPR is:

Article 6(1)(e) - The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. Where the official authority for ONS to produce, promote and safeguard official statistics is found in the Statistics and Registration Service Act 2007.

Article 9(2)(j) - The processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

The health and labour market statistical work programme is currently funded by the Treasury and potentially other funding bodies in the future. Some of the costs incurred will be covered by bespoke additional funding from the Treasury, which is additional funding beyond standard ONS baseline funding from the Treasury, for example, the Treasury’s Shared Outcome Fund. The Cabinet Office, Department for Work and Pensions and Department for Health and Social Care are all stakeholders in this work. Analysts and data experts from these departments may provide advice, but will never access the data.

Amazon Web Services provide IT hosting services to ONS and will store the data as contracted by ONS as a processor.

The Integrated Data Service (IDS) is a cloud-based Trusted Research Environment (TRE) where analysts process data for the purposes listed in this Agreement. Google UK Limited provide IT hosting services to ONS for the IDS and will store the data as contracted by ONS as a processor.

As of May 2025, the Office for National Statistics (ONS), working closely with NHSE and DHSC, has developed a Patient and Public Involvement and Engagement (PPIE) strategy and action plan which sets out how it seeks to build public understanding and trust in its work:

·         using health data to develop statistics in the public interest,

·         linking health and non-health data to facilitate research and analysis in the public interest, exploring for example, the relationship between interventions with health conditions (understood through diagnostic health data) and subsequent labour market outcomes (understood through linked tax and benefits data),

·         towards a strategic partnership development between NHSE and ONS to facilitate more effective sharing of NHSE health data with cross-government departments and researchers via ONS’ Trusted Research Environments.

This will be an ongoing, strategic plan of work, which will form an integral part of ONS’ overall engagement programme with the public to build trust and understanding in its objective, impartial statistical production in the public good, and will be shared and developed in collaboration with NHSE and DHSC.

Work towards delivering this plan is already underway, with ONS currently engaging key stakeholders in the sector representing, or well positioned to partner with ONS to facilitate engagement with, a broad range of public and patient groups and communities.

ONS has run a number of PPIE sessions with patients and charity collaborators, including for example a session with the Health Data PPIE Community Advisory Panel in February 2025, (which looked at recent ONS work using diagnostic data into bariatric surgery and labour market outcomes, and ONS’ health and non-health data linking plans). ONS has scheduled further meetings with a number of national patient-facing organisations through May, June and July 2025 to explain its work, understand their views and establish opportunities for collaboration on future PPIE work and advocacy. In early 2025, ONS also commissioned NatCen to run research on its behalf into public attitudes towards the use of health data in ONS statistics, using a mixed methods approach of qualitative interviews with individuals from seldom-heard groups and an online survey of more than 4,000 respondents.

ONS is also working to establish a citizen data panel, to enable two-way discussions with the public on aspects of health and non-health data linking, as well as community focus groups for specific demographics/condition-specific areas. ONS also plans to run public webinars to increase awareness of how it safely and securely uses health data and the potential benefits of data linkage for the public good.

No Data will flow to NHS England for the purposes of this Data Sharing Agreement.

NHS England, via the South West Data Services for Commissioners Regional Office (DSCRO), will provide the relevant records from the Diabetes Prevention Programme. The Data will contain directly identifying data items including (NHS Number, postcode and date of birth) which are required to link the Data at record level with data already held by ONS.

The Data will be stored on servers at ONS within an assured ONS data analysis environment that includes the following elements of security control:

• Need to know access applied through user account access and management.

• Access to the data is restricted to individuals granted access on the basis of a justified need to access the data

• Controlled ingest and export of data into/out from the environment

• Controlled account access using unique credentials based on job role

• Logged and monitored access of user activity within the environment

• Secure build configuration for infrastructure

• Vulnerability tested infrastructure with appropriate remediation and patching

• Compliance checks against security enforcing controls

• Architectural review against standards and best practice

• Staff security cleared to the appropriate level based on their supervised and/or unsupervised access to sensitive data in accordance with ONS clearance policies and data access processes

• Education and awareness of environment users covering security policies and secure working practices

• Operational support processes to securely manage the environment

• Risk assessment to identify security risks and mitigation actions to reduce this risk.

ONS Secure Data Environment users set up 'project spaces' and apply for access to data through the Information Asset Owner. Each 'project space' includes only the data required to carry out their analysis and only the users who require access to that data. Users will not be permitted to access identifiers for the purposes of analysis. ONS will keep the number of staff permitted to process identifiers to an absolute minimum, and these staff will have a higher level of clearance. All other staff will only be permitted to access non-identifying data.

Access is via the ONS Secure Data Environment will only do so via their ONS issued hardware. This may include access on ONS sites, or when working from home via VPN. All ONS users of the ONS Secure Data Environment have high levels of clearance, training and sign an auditable SyOps document with conditions of use of the environment.

This processing activity takes place in a dedicated ONS environment provided by Amazon Web Services, and based in England and Wales only.

The data will reside within Google Cloud Platform (GCP). All cloud services consumed for the storage and use of the data are scoped to securely managed GCP Projects. GCP Projects in scope for this project are not connected to ONS corporate networks. GCP Projects in scope for this project are accessible via the internet for administration/analytical work. Access is securely bound up with Google identity services, internet authentication proxies and multi-factor authentication. All platform infrastructure and storage is deployed into the Europe-west2 region (London) and in any of the 3 available zones for redundancy and high availability (where applicable). Processing of data can only be carried out on GCP infrastructure within the deployed region. Access to GCP platform is region locked to UK IP addresses only. Access to IDS and any data it holds is not permitted from outside the UK. Overseas connections are monitored, and connection attempts will lead to account suspension.

For remote access:

- Remote access will only be from secure locations situated within the territory of use (as further restricted elsewhere within the DSA if so done) stated within this DSA;

- Access controls granting users the minimum level of access required are in place;

- Remote access is only via secure connections (e.g., VPNs or secure protocols) to protect data;

- Multifactor authentication (MFA) is required for remote access;

- Device security, including up-to-date software and operating systems, antivirus software, and enabled firewalls are utilised for the remote access;

- All remote access is undertaken within the scope of the organisation’s DSPT (or other security arrangements as per this DSA) and complies with the organisation’s remote access policy.

The above applies in addition to any condition set out elsewhere within the DSA (e.g. who may carry out processing, and for what purpose).

The Data will not leave the UK at any time.

Access is restricted to employees of ONS. Following policy specified by the ONS Chief Security Officer, ONS user access to the data environment is only after approval of an application by the Information Asset Owner. A list of approved users is available for NHS England to request as required. All personnel accessing the Data have been appropriately trained in data protection and confidentiality. Staff accessing identifiable data have a higher level of security clearance.

The Data will be linked at person record level with HES and ECDS Data provided under separate Agreements with NHS England (DARS-NIC-175120-W5G2X and DARS-NIC-400304-S1P1B), ONS mortality data, Census data, and data on employment and benefits from the Benefits and Income Dataset (BIDS) provisioned to ONS by the Department for Work and Pensions (DWP), and the Pay As You Earn (PAYE) dataset provisioned to ONS by the HMRC, to achieve the statistical purposes. The key derived variables that ONS will link include: PAYE employee status, gross employee pay and maybe working hours (from HMRC) and benefits status and amount of benefits received (from DWP). These would be linked using Census ID to encrypted NINo (HMRC) and Census ID to CIS ID (DWP) look-up tables.

ONS is only interested in producing aggregate statistics and using these to uncover trends and other useful insights based on the non-identifiable 'attribute' information.

Only statistical disclosure controlled aggregate outputs will be exportable from the secure data analysis environment. Other than the initial transfer of the data from NHS England to ONS, the identifiable data will never be in transit and will always be protected by procedural controls in place.

To protect patient confidentiality, ONS has conducted a full Data Protection Impact Assessment (DPIA) for the NHS England health data that it controls and processes. This will apply to these data which are similar in nature and sensitivity to the NHS England health data that ONS already holds. The following are some of the key mitigations for the risks identified:

• The protections of the ONS secure data environment

• ONS staff have high levels of training and security clearance, and it is a criminal offence under the Statistics and Registration Service Act 2007 to disclose personal information held by ONS

• The data will be de-identified at the earliest opportunity and those conducting data linkage will be separate from those conducting analysis using linked de-identified attribute information

• Analysts will never seek to re-identify subjects and

• ONS is only interested in producing aggregate statistics for the public good

Analysts from the ONS will analyse the Data for the purposes described above.

The data will be used to produce official statistics. These will be released on the ONS website in the form of a statistical bulletin and statistically disclosure controlled aggregate data tables, and potentially in peer-reviewed scientific journals. Headline results may also be published on social media, and within a blog on the ONS website.

The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset(s) from which the information was derived.

These projects are funded until March 2025. Some outputs may be released before then. Some outputs may also be released later than this – e.g. if most /all of the statistical work is complete and all that is required is finalising the figures and arranging for publication.

However, notwithstanding that plan, it is possible additional/extended funding for the wider health and labour market work programme will be received. If that occurs, and the projects and use of these data are extended, then ONS will inform NHS England.

As per section 5a, the legal gateway under which data will flow from NHS England to ONS will be Section 45c of the SRSA 2007 (as amended by the Digital Economy Act 2017). This means ONS can require that data are shared as long as the data are required for its functions, and the share is in line with the statistical statement of principles that underpins these powers.

These considerations include that the purposes to which ONS puts the data must be in the public interest and serve the public good. However, for this legal gateway, the benefits do not need to be to health and social care specifically. This is unlike some other legal gateways under which NHS England data can be disseminated, for example section 251 of the NHS Act 2006, when research outcomes must benefit health and social care.

In the above context, the following will briefly cover the potential benefits:

The statistics produced are expected to provide better evidence on the impact of health on labour market participation, and vice versa, to policy and decision makers at the stakeholder Government departments (Treasury, DHSC, DWP). They will then use this evidence as part of their decision making about policy development/change. For the Diabetes Prevention Programme, this could provide better evidence of the impact of the programme and help optimise its design moving forward, for the benefit of patients – e.g. by helping them back into work.

The mechanism by which these benefits could be achieved is as described – by providing better evidence to policy makers, this could affect decisions made about policy design, thereby changing (improving) relevant public/health service provision.

ONS has a wide range of stakeholders and partners in the health statistics arena beyond Government departments. For example, think tanks and charities. ONS will ensure all relevant partners are made aware of these statistics once produced. As noted in section 5c, the outputs may include blogs and social media for the general audience, as well as papers in academic journals aimed at the scientific community, which will assist in maximising reach.

Not stated in the register.