Car parking arrangements and contracts at Trust sites
Case reference FOI2026/02551
Received 21 June 2026
Published 20 October 2026
Request
1. A recent response includes the statement - the Trust oversees the contract and receives high‑level assurance information - please can you provide information on the manner in which the contract is overseen and what high level assurance is received. This should at the very least cover evidence of compliance with NHS Car Parking Guidance 2022
2. Please can you state how many formal and informal complaints (PALS) enquiries you have received relating to parking at any of your sites for the last 2 years.
3. Please can you advise how many of the above resulted in the cancellation of PCNs.
4. A parking contract with an external provider allows a non NHS provider to come onto your site and obtain registration details for vehicles belonging to patients and their families. The KADOE contract with the DVLA then allows the contractor to obtain names and addresses of the legal keepers of the vehicles. This means you are facilitating a third party to obtain highly sensitive data (hospital attendance) over which you apparently have no control. Please can you provide a copy of the mandatory Privacy Impact Assessment that was completed and risk assessed before the latest contract for car parking was agreed. I am particularly interested in any discussion relating for the potential for third parties to be made aware of someone's attendance at a health facility without their consent.
Response
1. A recent response includes the statement - the Trust oversees the contract and receives high‑level assurance information - please can you provide information on the manner in which the contract is overseen and what high level assurance is received. This should at the very least cover evidence of compliance with NHS Car Parking Guidance 2022
The Trust oversees the supplier's contract through a formal governance framework where high-level assurance is provided. This is provided through:
· Monthly contract review meetings chaired by the Trust, with a structured agenda
· Regular supplier management reports including KPI data
· Ongoing monitoring and action tracking, ensuring issues are identified, escalated, and resolved within agreed timescales
· Oversight of complaints, patient experience, and operational data
· Reviews of business continuity, information governance, and system performance
The Trust's parking policies set the compliance to NHS Car Parking Guidance for which the contracted services align and support, including alignment to free car parking for those with the greatest needs, the Trust's own arrangements towards concessions and voluntary elements, and contracted-out car parking, where the supplier are members of the British Parking Association (BPA) and Approved Operator Scheme (AOS).
2. Please can you state how many formal and informal complaints (PALS) enquiries you have received relating to parking at any of your sites for the last 2 years.
186
3. Please can you advise how many of the above resulted in the cancellation of PCNs.
83
4. A parking contract with an external provider allows a non NHS provider to come onto your site and obtain registration details for vehicles belonging to patients and their families. The KADOE contract with the DVLA then allows the contractor to obtain names and addresses of the legal keepers of the vehicles. This means you are facilitating a third party to obtain highly sensitive data (hospital attendance) over which you apparently have no control. Please can you provide a copy of the mandatory Privacy Impact Assessment that was completed and risk assessed before the latest contract for car parking was agreed. I am particularly interested in any discussion relating for the potential for third parties to be made aware of someone's attendance at a health facility without their consent.
Oxford University Hospital (OUH) NHS Foundation Trust sites are multifunctioning in the activities taking place on site, this is therefore reflected in those using the car parks. On OUH sites and in addition to patients, car park users include but are not limited to visitors, Trust employees, non-trust tenants, other Trust's employees and visitors, educational spaces users, training facility users, arts and music event visitors, contractors, and volunteer drivers. Therefore, the collection of Vehicle Registration Numbers alone is not sensitive in relation to translating to hospital attendance, in addition to this there is no cross referencing of the ANPR data with any patient systems or data.
The Trust maintains copies of Data Protection Impact Assessments where we are the Controller of data. The Trust is not the data controller for the ANPR system as such the Trust does not hold a DPIA for the processing of data by the ANPR system.
All data held and collected through the ANPR system is done so in accordance with Information Commissioner’s Office guidance and in line with BPA best practice guidance. The supplier is an Approved Operator of the British Parking Association, is fully compliant with the Data Protection Act 2018 (DPA), holds Cyber Essentials Plus trademark and is reviewed through the NHS Data Security and Protection (DSP) Toolkit process having achieved 'Standards met' against Version 8 of the standard in June 2026.
Documents
This is Oxford University Hospitals NHS Foundation Trust's response to a freedom of information (FOI) or environmental information regulations (EIR) request.
You can browse our other responses or make a new FOI request.