Consultations and surveys run by NHS Digital in Citizen Space - Privacy Policy

Please see our Corporate Transparency Notice for:

  • Controller’s contact details
  • Data Protection Officer’s contact details
  • Your rights
  • How to complain

Purpose and legal basis for processing

We (NHS Digital – the data controller) process personal data provided in response to our consultations and surveys to inform the design, implementation and use of NHS Digital programmes and services.

If you have indicated that you would like to be contacted to discuss your response, we’ll process your contact details to get in touch with you.

Following the end of each consultation/ survey we shall publish a summary of responses received; these will be anonymous unless you have given your consent to publish information which may identify you.

If you voluntarily contact us via the Submit Feedback form, the site will record your screen resolution, IP address, browser version and the page you visited prior to leaving feedback. This personal information will be used exclusively to help us to assist you.

We also collect IP addresses for the purposes of system management and to audit the use of our site.

The legal basis we rely on to process your personal data is your consent under Article 6 (1) (a) of the GDPR.

How long we keep your data

We keep consultation/survey responses for 3 years (from the date the results of the consultation/survey were published)

Personal data collected by the ‘Submit Feedback Form’ on the site will be kept for six months after which it will be deleted but analysis of feedback (which cannot identify you) may be kept.


What are your rights?

Right to be informed - You have the right to know how we use your personal data.

This Privacy Notice along with the consultation overview available on the home page of each consultation provide full information about how we will use your personal data

Right of access - You have the right to ask for copies of your personal data.

Citizen Space provides an email receipt to every consultation respondent, with a PDF attachment containing all the information submitted via the consultation/survey. The email also provides a unique Response ID number which can be used to locate the submission in case of enquiry.

You have a right to request a copy of any personal information we are holding as part of your consultation response at any time to check the accuracy of the information held.

Right to rectification - You have the right to have personal data rectified if it is inaccurate or incomplete.

In Citizen Space, consultation responses cannot be edited or deleted once submitted. This creates an audit trail and defends against any real or perceived risk of tampering with response data.

However, it is possible for a replacement response to be created, and the original response removed. For "removed responses" the data is still held but no longer used for analysis and reporting. Citizen Space provides an audit trail of when and why the response was removed. To request such rectification, please contact:

Right to restrict processing - You have the right to stop us processing your personal data e.g. where you believe we hold inaccurate personal data we will stop processing until accuracy has been checked. To make such a request, please contact:

Right to withdraw consent / right of erasure - We rely on your consent to process the personal data you give us in response to a consultation or survey. This means you have the right to withdraw your consent at any time.

To request such erasure, please contact:

Right to data portability - You have the right to obtain your personal data to reuse for your own purposes. We can supply your consultation response, including your personal data, in an open format. To request this, please contact:

For more information on your rights, and when they apply, please see our Corporate Transparency Notice.


Sharing your information

We do not pass on your details to any third party or other government department, unless stated on the home page of an individual consultation. You will have the option to refuse consent for sharing.


Do we use a data processor?

Yes – our consultations and surveys are hosted on the Citizen Space site which is run by Delib Limited (the data processor). For more information, please see Delib’s privacy notice.

The site uses cookies for site navigation and session management. These cookies do not contain any personally identifiable information. They are used only to help you navigate through the site and complete consultations. They are not persistent and contents are deliberately deleted as soon as they are no longer useful for these purposes.

The site also uses Google Analytics. Google Analytics uses cookies internally. Analytics data is not associated with any information collected as part of any consultation.

More information about analytics and cookies can be found on Delib’s cookies page for Citizen Space.


Delib Privacy Information

Delib’s software (this website) enables organisations to set up and operate democratic exercises, through which they will engage with you.

When you access and use this site, your information submitted to these exercises will go to the data controller: the organisation running this site. If you have provided it, this information may include personal data (e.g. your name, age, contact details etc.).

Delib’s role is to process this data on behalf of the controller. Processing means (among other things): making sure this website runs properly, that your data is securely stored and is available to the controller so that they can do their work effectively.

Our primary purpose is in making software platforms that help you to have your say. To do this we need to make sure that when you do, your data is safe, secure, and can be worked with effectively. So that’s what we do. Delib will not access your personal data unless requested to do so by the controller, and only for the purposes of helping them or you.

The data controller will have a privacy policy or other information notice, which sets out how they will hold and use the information you provide, as well as your rights in relation to that information. This policy or notice may be included on this page, or can be obtained by contacting them.

If you have any questions or requests about your personal data, these should be sent to the data controller in the first instance. Delib cannot directly deal with such enquiries as it does not control how your information is used.

Collection of Browser Information

Delib stores information which is provided by your computer when you use the website. For example, your browser type, IP address, language preference, referring site, and the date and time. Delib's purpose in collecting this information is to maintain the security of the website and for the purposes of operating and improving the software.