The NHS England Fit and Proper Person Test Framework (FPPT) took effect on 30 September 2023. From this date onwards, NHS trusts, Foundation Trusts and ICBs should:

  • obtain references using the new Board Member Reference template for all new appointments to Board Member roles
  • carry out assessments of whether Board Members meet the FPPT, both at the time of appointment and on an ongoing basis, following the guidance in NHS England’s Framework
  • complete and retain references using the new Board Member Reference template for any Board Member who leaves the Board for any reason, regardless of whether a reference has been requested

The Framework reminds NHS organisations that they should communicate with all board members whose details will be included in the Electronic Staff Record for the purpose of the FPPT. The Framework states that “by doing so directors will be afforded the opportunity to object if they have concerns regarding the proposed use of the data… and data controllers will be able to consider these concerns and amend their approach if necessary”.

As an immediate step, all NHS organisations caught by the Framework (whether NHS trusts, Foundation Trusts or ICBs) should review their relevant Privacy Notices and ensure that, for individuals classed as Board Members for the purposes of the Framework, these reference the processing of personal data for the purposes of the FPPT, and set out an appropriate lawful basis for doing so. This lawful basis may be different for NHS trusts and Foundation Trusts (which are subject to the regulatory requirements under the Health and Social Care Act) compared to ICBs which, whilst not registered with CQC, are still expected to comply with the Framework.

There has been some debate as to whether it is also necessary to amend directors’ contracts of employment to make reference to this use of their personal data. However, whilst it is important to ensure Privacy Notices accurately reflect the position, there should be no need for this processing of personal data to be specified in the contracts. It may be helpful, though, for the contracts to reflect when roles are subject to the FPPT.

If you require support in connection with any data protection, governance, regulatory or HR issues arising from the Framework – whether FPPT policies, privacy notices, Board briefings, or advice on individual assessments or references – please get in touch with Carlton Sadler, PartnerAlastair Currie, Partner or Ben Pumphrey, Senior Associate.

Our use of cookies

We use necessary cookies to make our site work. We'd also like to set optional analytics cookies to help us improve it. We won't set optional cookies unless you enable them. Using this tool will set a cookie on your device to remember your preferences. For more detailed information about the cookies we use, see our Cookies page.

Necessary cookies

Necessary cookies enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Analytics cookies

We'd like to set Google Analytics cookies to help us to improve our website by collection and reporting information on how you use it. The cookies collect information in a way that does not directly identify anyone.
For more information on how these cookies work, please see our Cookies page.