UK General Data Protection Regulations (UK-GDPR) Privacy Notice

How we use personal data for accident reporting, recording and analysis

This privacy notice sits beneath National Highways’ top level privacy notice. 

Please see the main privacy statement for details on your rights and who to contact about use of personal data.

What personal data do we collect and handle?

We collect and handle personal data as part of accident reporting, recording and analysis.

The information relates to workplace accidents involving:

  • National Highways staff
  • people working for or on behalf of National Highways (for example contractors and suppliers)

What legally allows us to collect and handle information about you?

Our legal authority under The Health and Safety at Work Act (1974) allows us to collect and handle information about you.

Your data will only be processed with your consent. You may withdraw consent at any time by contacting us.

We will advise you prior to any further processing taking place and this will also only be undertaken with your consent.

How long do we keep your information for?

As long as necessary to meet our legal obligations (see above).

Every 10 years we will review personal information to decide whether we still need to keep it.

Who do we share your data with?

We may occasionally share your data with specific individuals or teams in organisations that are carrying out research to help us understand how and why incidents occur. When we do this, we will share your data for specific and defined purpose specified in our contract with the organisation working with us.

We will require the individuals or teams who we share your data with to treat your data as confidential, even if it doesn’t contain any personal information. The data we share may only be used for the purposes defined in the contract and may not be shared with anyone else (not even people within the same organisation).

Once the work we have asked to be done is completed and we have the final outputs from the work, we require the organisation that carried out the research work for us to destroy any copies of your data that they hold.