The two-minute version
- Your practice is responsibleAs the data controller, the practice decides how patients’ information is used, and stays responsible even when a supplier (the data processor) does the work.
- You need a Data Protection Officer (DPO)Practices providing NHS services must have a DPO. They can be shared or external.1
- Think it through firstA data protection impact assessment (DPIA) checks the risks before a new tool handles patient information.2
- Get it in writingA data processing agreement (DPA) sets out what the supplier may do with the data.
- Tell patientsYour privacy notice must say how their information is used, and change when that changes.3
The house keys analogy
Data protection is like giving a cleaner a key to your home: you decide who comes in, agree what they’ll do, and get the key back when they leave. Click through the steps.
Our example practice
Oakfield Surgery
A fictional practice we use throughout the toolkit: a practice of 9,000 patients with five GPs, two nurses, a practice manager and a care navigation (reception) team. Like every practice, Oakfield must keep an online consultation tool open throughout core hours, a contract requirement since October 2025. Oakfield is switching to a new tool, Kestrel Consult, and needs to show it complies with data protection law. In simple terms, patients send requests for appointments through the practice website, a care navigator sorts them, and the duty doctor reviews anything needing specific clinical input.
Kestrel Consult and the other product names in Oakfield's examples are made up.
1 of 8
You’re in charge
The data controller
At homeYou decide who comes into your home, and why.
At Oakfield SurgeryOakfield is the data controller for its patients’ information. It decides what the online consultation tool handles and why. That responsibility stays with Oakfield even when a supplier does the work.
2 of 8
Someone works for you
The data processor
At homeA cleaner comes in to do a job for you. They don’t decide what happens in your home.
At Oakfield SurgeryThe supplier is a data processor. It handles patients’ requests only on Oakfield’s instructions.
3 of 8
Agree it in writing
The data processing agreement (DPA)
At homeWhich rooms, which jobs, no spare keys cut, nobody else brought round.
At Oakfield SurgeryA data processing agreement (DPA) sets out what the supplier may do with the data, where it’s kept, for how long, and who else it uses.
4 of 8
Think it through first
The data protection impact assessment (DPIA)
At homeBefore you hand over the keys, you think about what could go wrong and how to stop it.
At Oakfield SurgeryThe DPIA looks at the data risks before go-live: who can see requests, where they’re stored, and what happens if they leak. It works like the risk assessment in clinical safety: what could go wrong with the data, and the controls and mitigations that reduce it.
5 of 8
Have a good reason
The lawful basis
At homeThere’s a clear reason the cleaner is there: to clean.
At Oakfield SurgeryProviding care is part of the practice’s public task, and health information may be used for health care, so patients don’t sign a consent form, but they must be told. Who may look is a separate rule: staff only open the records of patients they’re caring for. A receptionist looking up a neighbour’s record breaks confidentiality, even though the practice is allowed to hold it.
6 of 8
Tell the neighbours
Transparency
At homeSo nobody is alarmed to see a stranger letting themselves in.
At Oakfield SurgeryOakfield updates its privacy notice and website, so patients know the tool exists, what happens to their information, and who to ask.
7 of 8
Keep it secure
Data security
At homeA key safe, an alarm code, and the door locked when they leave.
At Oakfield SurgeryStaff log in securely (for example with two-factor authentication through an authenticator app), only people who need to can see requests, and the supplier meets NHS security standards.
8 of 8
Get the keys back
Ending the contract
At homeWhen the cleaner stops coming, you get every key back and check no copies were made.
At Oakfield SurgeryIf Oakfield stops using the tool, the supplier returns or deletes the data and confirms it in writing.
Consent: two different things
“Consent” means different things in two sets of rules, and they answer different questions.
Data protection law
- The question
- Is the practice allowed to use this information at all?
- For direct care
- Not consent. NHS care is a public task, and health information may be used to provide health care.3
- Example
- A patient doesn’t sign anything for their GP to write up a consultation in their record.
The duty of confidentiality
- The question
- Is it right to share it with this person?
- For direct care
- Implied consent. Patients expect the people caring for them to see it, unless they object.3
- Example
- A referral letter to the hospital is fine. Telling the patient’s employer is not, unless the patient agrees.
So, for an AI scribe: asking the patient first is about being open and respecting their wishes, not GDPR consent. If they say no, don’t use it.3
The rules that apply
- The Data Security and Protection Toolkit (DSPT)A yearly self-assessment against NHS data security standards.6
- The national data opt-outLets patients opt out of research and planning uses, not their own care.5
- The Caldicott PrinciplesEight principles for using confidential information well. Every practice should have a Caldicott Guardian.4
- The duty of confidentialityInformation given in confidence shouldn’t be shared without a good reason.
- UK GDPR and the Data Protection Act 2018The law on using personal information. Health information is “special category” data, with extra protection.
The law is at the base and underlies everything; the yearly check is at the top.
UK GDPR in seven principles
Everything in data protection law comes back to seven principles. They’re covered in yearly staff data security training.7
- Lawful, fair and openHave a lawful basis, and tell patients what you do with their information.
- Only for the stated purposeInformation collected for care isn’t quietly used for something else.
- No more than neededCollect and share only what the task needs.
- AccurateKeep it correct and up to date, and fix errors.
- Kept no longer than neededFollow the NHS records retention schedule.
- SecureProtected from loss, theft and the wrong eyes.
- AccountableBe able to show you comply: DPIAs, contracts, training records.
Who does what
- The practice (partners)The data controller, accountable for how information is used.
- Data Protection OfficerAdvises on the law and DPIAs. Every practice needs one, but it can be outsourced.1
- Caldicott GuardianMakes sure confidential information is used correctly. Consulted on the DPIA. Every practice needs one.
- Senior Information Risk Owner (SIRO)Accepts the remaining risk in a DPIA. Often a partner.
Some problems are both clinical safety and data protection, like an AI scribe note filed to the wrong patient. Record them in both places. See how the areas fit together.
References
- Appointing a data protection officer (DPO). BMA
- Data protection impact assessments. Information Commissioner’s Office
- Consent and confidential patient information. NHS England
- The Caldicott Principles. National Data Guardian
- Understanding the national data opt-out. NHS England
- Data Security and Protection Toolkit. NHS England
- A guide to the data protection principles. Information Commissioner’s Office
Sources on this page last checked 3 November 2026.