Further sensitive processing conditions

NHSCFA conditions for processing sensitive data.

Further conditions for processing sensitive data for a law enforcement purpose are detailed in Schedule 8 of the Data Protection Act 2018. The most relevant to NHSCFA are:

Statutory purpose

The processing is necessary for the exercise of a function conferred on a person by an enactment…and is necessary for reasons of substantial public interest.

Legal claims

The processing is necessary for:

  • the purpose of, or in connection with, any legal proceedings, including prospective legal proceedings,
  • the purpose of obtaining legal advice; or
  • is otherwise necessary for the purposes of establishing, exercising or defending legal rights

Preventing fraud

The processing (including disclosure) is necessary for the purposes of preventing fraud or a particular kind of fraud, and

  • NHSCFA is acting in accordance with arrangements made by an anti-fraud organisation.


The processing is necessary for

  • statistical purposes

Help us improve cfa.nhs.uk

Tell us what's happened so we can fix the problem. Please do not provide any personal, identifiable or sensitive information.


Thanks for the feedback!