1. Introduction
You can read the MHRA Privacy Notice to find out in general terms the types of personal data we process and why; as well as information about your rights and how to raise concerns.
This privacy notice sets out the approach to this consultation that the MHRA will take to handle information appropriately and to comply with information legislation.
This privacy notice covers documents gathered and created during this consultation and anything in which information of any description is recorded, whether in paper or electronic form.
2. Legal requirements for information management and privacy
The consultation complies with data protection legislation including the Data Protection Act 2018 and the UK General Data Protection Regulation (UK GDPR).
We rely on UK GDPR Article 6(1)(e) as our legal basis for processing your personal data. This allows us to process personal data when this is necessary for the performance of our public tasks in our capacity as a regulator.
Information provided to the MHRA may include some special category personal data. Our lawful basis for processing such information is set out in UK GDPR Article 9(2)(i) and the Data Protection Act Schedule 1, Part 1(3). Both relate to situations where the processing is necessary for reasons of public interest in the area of public health.
3. Lawful basis and purpose of processing personal information
The consultation may collect and use personal information for the purpose of gathering views to inform our approach to potential regulation of Advanced Therapy Medicinal Products.
In the case of personal information, the purpose is to read and analyse the information provided to improve understanding of the key considerations raised by individuals and organisations for our work to effectively regulate Advanced Therapy Medicinal Products.
The information may also be used to help explore issues and direct further areas of research. Where this may be done, no personal information will be used.
4. Security and confidentiality
Only members of the MHRA working on this consultation will have access to the data. These would include the following: Healthcare, Quality and Access; Safety and Surveillance and the Inspectorate. Authorised personnel from SurveyOptic Ltd (the online survey platform) will also have access to personal information. Those who do are aware of their obligations and responsibilities when handling personal and confidential information. They are subject to employment, contractual and other professional obligations regarding confidential and official information, both during the review and afterwards.
All personal and confidential information is stored securely to prevent loss or inappropriate access.
5. Sharing information
The MHRA will hold the personal information you provide in this consultation and use it for the purpose of informing the approach to regulating Advanced Therapy Medicinal Products.
Information published in response to this consultation, including personal information, may be published or disclosed in accordance with the access to information regimes. These are primarily the Freedom of Information Act 2000 (FOIA), the Data Protection Act 2018 (DPA), the UK General Data Protection Regulation 2016 (GDPR) and the Environmental Information Regulations 2004.
We would not publish data where it would lead to a breach in data protection principles. However, the information you send us may need to be published in a summary of responses to this consultation.
6. Retention and destruction of documents
Following the consultation, a response to the consultation will be published outlining its findings and recommendations. It is anticipated that the final response will not include any personal data. The contributions will be retained for a period of 5 years after the final consultation response has been published.
7. Rights
You have several rights which are outlined in the MHRA Privacy Notice: https://www.gov.uk/government/publications/mhra-privacy-notice. For greater detail on when they apply please refer to the Information Commissioner’s website If you wish to exercise any of your rights, or have any questions or concerns, please contact our Data Protection Officer at dataprotection@mhra.gov.uk