GP data for Consented Research Service

You can find detailed information about the GP Consented Research Service on the NHS England website together with the Data Provision Notice and the transparency notice.

We are ensuring that where a patient consents to take part in a research study  which includes explicit common law consent for use of the data from their GP record NHS England is making this data available to approved research studies in a way that reduces the burden on GP practices.

We are also ensuring that data from GP records is made available to approved research studies where a consultee’s view is that an individual lacking capacity should take part in the research study and would have wished to do so if they had the capacity to decide.

The GPES Data for Consented Research Direction 2026 legally requires NHS England to collect data from GP records and share it with approved research studies.

No. It is not a new data collection, but it is a new purpose for using data which is already being collected by NHS England.

Data is already being collected from GP practices under the GP Data for Pandemic Planning and Research (GDPPR) Direction. However, this direction only applies to the collection and use of data for COVID-19 purposes. The GPES Data for Consented Research Directions 2026 allow the GDPPR data to be used for the additional purpose of consented research by approved research studies, without the need for a separate collection of data.

No. This data collection only applies to people who have explicitly agreed to share their GP record with the specific approved research studies. Where explicit consent has been given for a specific use of data then the national data opt-out does not apply. If a patient does not provide their explicit consent to an approved research study, then their data will not be used as part of this service.

If a participant changes their mind, they can contact the approved research study and let them know they no longer wish for their data to be shared. This will be actioned by the study liaising with NHS England. Participants should be referred to their study materials for their options.

NHS England will only share information with approved research studies. Approved research studies are published on NHS England’s website. For a research study to be approved, it must meet strict rules set by the Department of Health and Social Care and by NHS England.

As controller for the data collection, NHS England is required to share the information lawfully and appropriately. Checks include ensuring that:

• Data Security and Protection Toolkit requirements, or equivalent, are met for the organisation running the study
• robust and thorough processes are in place for gathering explicit consent
• the research study has appropriate transparency arrangements
• if participant data is to be made available to other organisations under a sub-licence from NHS England, access by sub-licensees should be through a Secure Data Environment (SDE) that complies with all Department of Health and Social Care policy on SDEs for health and social care data
• NHS England’s Advisory Group on data has provided advice on each request to access the data, following independent and expert scrutiny

The GP practice is controller for the processing of personal data that it collects from patients and holds.

For the purposes of the GPES Data for Consented Research Direction 2026, once the GP practice shares the data with NHS England, NHS England becomes the controller for the data it holds, processes and discloses to approved research studies as determined by the directions.

When NHS England shares data with an approved research study, the approved research study is a controller of the data they receive from NHS England.

GP practices should ensure that their privacy notices are updated template wording has been provided by NHS England.

NHS England has published a Data Protection Impact Assessment (DPIA) for its GP Data for Consented Research Service.