GP Data for Consented Research Service: Transparency Notice

Data from GP records helps support important health research. In the past, this data was not always shared with researchers, even when people agreed to take part. This was because GP practices had to check each person’s consent before sharing any information. This took a lot of time and effort.   

To help save time for GP practices, NHS England, who already collect this data from GP practices for certain purposes relating to the COVID-19 pandemic, will share some of it with specific research studies approved to access their participant data (approved research studies). NHS England will only share data for patients where:

• explicit consent has been provided by or on behalf of the patient to their data being shared with the approved research study for health research; or
• someone, such as a family member (called a consultee), says a patient who lacks capacity should, and in their view would wish to, take part in the research. This is permitted under the Mental Capacity Act 2005

In this notice we refer to this group of patients as “consented patients”. Read the details of all approved research studies. 

This transparency notice explains:

• what data we collect about you and where we collect it from (we call this “personal data”)
• our legal grounds for collecting and sharing it
• who we share it with
• what your data protection rights are

We already collect data from GP practices in England to analyse and share it for COVID-19 planning and research purposes. The data we already collect is about all patients who are currently registered with a GP practice in England or with a date of death on or after 1 November 2019 and includes:

• NHS number
• postcode
• address
• surname and forename
• sex
• ethnicity
• date of birth
• date of death

It also includes coded health data which is held in your GP record such as details of:

• diagnoses and findings
• medicines and anything else you have been prescribed
• investigations, tests and results
• treatment and outcomes
• vaccinations and immunisations

If you have registered a Type 1 objection with your GP practice, your practice will not share your personal identifiable information, except when it is being used for the purposes of your care and treatment or where there is a legal requirement to do so.

NHS England agreed with the National Data Guardian, the British Medical Association and the Royal College of General Practitioners that we would not collect information about patients who had registered a Type 1 objection for COVID-19 planning and research purposes. As we are using the same data collection for the consented research service, this means that if you registered a Type 1 objection, even if you have provided explicit consent to share your data, your data has not been collected by NHS England. It will not therefore be available to share with an approved research study as part of this service.

Collecting your data 

The Secretary of State for Health and Social Care has directed NHS England under section 254 of the Health and Social Care Act 2012 (2012 Act) to collect data held in GP health records so that it can be shared for consented research purposes with approved research studies.

The Directions are called the GPES Data for Consented Research Directions 2026 (Consented Research Directions). To minimise the work for GP practices, NHS England has been directed to use the same data it already collects from GP practices under the COVID-19 Public Health Directions 2020, which it already uses for COVID-19 planning and research purposes.

All GP practices in England are legally required to share data with NHS England for consented research purposes under section 259(1)(a) of the 2012 Act. GP practices are notified of the requirement to provide NHS England data through the Data Provision Notice issued by NHS England.

Controller of your data

NHS England is the controller under the UK General Data Protection Regulation (UK GDPR) of the personal data collected for consented research purposes.

Legal grounds for collecting your data

Data protection law requires NHS England to have legal grounds to process personal data under Article 6 of UK GDPR. It also requires legal grounds to be met to process “special categories of personal data”, which includes data relating to your health, under Article 9 of UK GDPR. We also need to have legal grounds under Schedule 1 of the Data Protection Act 2018 in certain circumstances.

Our legal grounds for collecting your personal data under data protection law are:

• Article 6(1)(c): as we have a legal obligation to process your personal data under the Consented Research Directions; and  

• Article 9(2)(g) – as there is a substantial public interest for processing special categories of personal data, so that NHS England can exercise its statutory functions under the Consented Research Directions. We are also permitted to process your data for this purpose under paragraph 6 of Part 2 of Schedule 1 of the Data Protection Act 2018.  

NHS England has specific powers to share your data under the 2012 Act and the National Health Services Act 2006 where you have consented to sharing your data with an approved research study. We also have powers to share data where a consultee acting on your behalf has advised an approved research study that a patient who lacks capacity should, and would wish to, take part in the research under the Mental Capacity Act 2005.

Our legal grounds for sharing your personal data under data protection law are:

• Article 6(1)(e) - performance of task in the public interest or exercise of official authority, as we have legal powers to share your personal data and
• Article 9(2)(g) - as there is a substantial public interest for processing data relating to your health and other special categories of personal data, so that NHS England can exercise its statutory functions under the Consented Research Directions. We are also permitted to process your data for this purpose under paragraph 6 of Part 2 of Schedule 1 of the Data Protection Act 2018; or
• Article 9(2)(j) - processing these is necessary for scientific research purposes or statistical purposes in accordance with Article 89(1) of UK GDPR. We are also permitted to process your data for these purposes under paragraph 4 of Part 2 of Schedule 1 of the Data Protection Act 2018

We share information about consented patients with approved research study teams. Approved research studies are published on our website. For a research study to be approved, it must meet strict rules set by the Department of Health and Social Care and by NHS England defined within the Consented Research Directions.

Researchers must first apply to NHS England’s Data Access Request Service (DARS). If their application meets the approval criteria and they become an approved research study, they will only receive data where there is a Data Sharing Framework Contract and a Data Sharing Agreement requiring them to meet specific conditions, in place with NHS England.

Details about data shared with all approved research studies will be published by NHS England in the Data Uses Registers.

Under data protection law, you have the following rights in relation to your personal data processed as part of the consented research service:

• Your right to be informed – You have the right to be told how and why we are using your personal data. We have published this transparency notice to provide you with this information
• Your right to get copies of your data – You have the right to ask us for copies of your personal data (right of access). For more information, see how to make a subject access request
• Your right to get your data corrected – You have the right to ask us to correct (rectify) your personal data if you think it is inaccurate or incomplete
• Your right to limit how we use your data – You have the right to ask us to limit the way we use your personal data (restrict processing) in certain circumstances.

You can find out more about making a request to exercise these rights and details for contacting our data protection officer.

If you have given your explicit consent for your data to be used in a research study, your national data opt-out (if you have one) will not apply.

If a consultee has advised that patient lacking capacity would wish to take part in a research study, then their national opt-out (if they have one) may not apply.

You can find out more about how the NHS uses your data and the national data opt out.

For further information about how NHS England processes your data please see the NHS England Privacy Notice. 

We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.