Around 20 million people unaware of plan to share GP medical records with NHS database, Which? finds

Almost half (45%) of adults in England, around 20 million people, are unaware of plans for medical records about them held by their local doctor to be shared with an NHS database, Which? research has found. 

The consumer champion’s survey shows why the government was right to announce recently that it is delaying implementation of the General Practice Data for Planning and Research (GPDPR) programme, launched in May this year, and why Which? believes there needs to be better communication and transparency from NHS Digital and the government moving forward.

There may be benefits to effective sharing of health record data, and the government has said the data will only be available to third parties for health and care purposes and that identifying personal information, such as date of birth, will be replaced with unique codes. But the benefits of this specific scheme do not seem to have been communicated effectively so far.

It is clear from Which?’s survey of nearly 1700 adults in England that there is low awareness of these data sharing plans, and concern from people that they do not have sufficient information to make a choice. This has then bred suspicion among some people that data could be misused in the hands of commercial organisations.

Of those who had been unaware of the plans, four in 10 (39%) said they would now likely want to opt out after being told about them in the survey.

Which? found that of just over half (55%) who had heard of the scheme, seven in 10 (71%) felt the NHS had not publicised it well.

Half of the respondents in Which?’s survey who had heard about the NHS plan said that this had been via the news or social media, not from the information put out by NHS Digital on its website and in GP surgeries – which many of us have not visited in person due to Covid restrictions. This raises concerns about the accuracy of information people were seeing, as NHS Digital had not publicised it widely in the news or online.

A lack of transparency around the scheme has the potential to impact people’s trust in the NHS. At the start of the survey three quarters of respondents (75%) said they trust the NHS to handle their GP medical records safely and transparently. However, four in 10 (42%) said hearing about the scheme in the survey had made them trust the NHS less.

Four in 10 (38%) of the people that took part in Which?’s survey said they were not happy that the NHS wants to share data from their GP medical records under this new scheme.

Of the group who had heard of the scheme and had opted out, a third (32%) of them said that they had found the opt-out process difficult.

A number of people who opted out of the scheme said it was because they did not want their data to be sold to private companies – even though NHS Digital has said that the data it collects will not be shared with marketing or insurance companies. The data will not leave the NHS – although third parties, some of which are commercial, will be able to access it. The NHS Digital webpage for the GPDPR says it has a strict and well-established process for providing access to data for external organisations.

A separate recent Which? survey about health and wellbeing apps found that about half of people (53%) would be comfortable sharing their health data with public health bodies, but only a third (31%) feel the same about it going to private companies that are developing health products and services.

The GPDPR would see GP surgeries in England automatically upload and share the medical records of every patient in England to an NHS Digital platform, unless the person has opted out. These records include details of people’s physical, mental and sexual health, as well as wide-ranging data including appointments, test results and medications from over the past 10 years, and information about sex, ethnicity and sexual orientation. It does not include names, written medical notes, and certain data that GPs are not permitted to share by law, including information about IVF treatment and gender reassignment surgery.

It is worth noting that medical data can already be used to further scientific research without this scheme, under the General Data Protection Regulation (GDPR). It can be shared, for example, when required by law, when consent is given to participate in clinical trials or when there is an overriding public interest.

NHS Digital says data will be pseudonymised which means details that could directly identify people such as post code and date of birth will be replaced with unique codes before they leave the GP’s surgery. However the NHS notes that it will be able to use the software to decode the data in certain circumstances, and where there is a valid legal reason such as participating in a clinical trial. It will not collect patients’ names or full addresses.

NHS Digital has said GPDPR will see information shared with, among others, research organisations, including universities, charities, clinical research organisations that run clinical trials and pharmaceutical companies – but Which? feels this list could be open to interpretation and more clarity is needed on exactly who can access the data. NHS Digital told Which? that it is hard to narrow down the list as it is primarily interested in the reason given for accessing the data, rather than the type of organisation that makes the request.

NHS Digital recently announced that it will delay collecting data under the new scheme until public awareness of the programme has been increased and privacy safeguards have been met – the deadline had previously been 1st July and then delayed to 1st September after pushback from medical professionals, MPs and interested groups.

Which? supports this further delay and believes that providing full transparency and better communication about the scheme will enable people to understand exactly how their data will be used, so they can make a clear and informed choice for themselves.

Rocio Concha, Which? Director of Policy and Advocacy, said:

“The coronavirus crisis has thrown into sharp relief the opportunity for health data to be used in ways that benefit patients and society in general  – however it’s really important to engage the public effectively on how their data is going to be used and the governance of data sharing with third parties.

“NHS Digital and the government are right to delay implementation of the GPDPR scheme and must now go to greater lengths to engage the public, raise awareness of the scheme, and increase people’s understanding of it through better communication and transparency.”

Notes to editors:

  • Survey on NHS opt-out details: On behalf of Which?, Opinium Research conducted a 2,000 nationally representative survey of UK adults aged 18+ of which 1,681 were adults living in England. Fieldwork took place between 6th and 9th July 2021.

  • Survey on Health app data: Yonder, on behalf of Which?, surveyed 2,042 UK adults (of whom 866 were current users of either a health app or wearable), online between the 26th and 27th May 2021. Data was weighted to be representative of the UK population by age, gender, region, social grade, tenure and work status.

Rights of reply

NHS Digital 

An NHS Digital spokesperson said: 

“Data is already being collected from GPs and has previously been used to better understand and develop cures for all types of serious illnesses and plan the most effective services for the NHS. During the pandemic it has been used to support the vaccine roll out and develop lifesaving treatments for coronavirus.

“We know we need to take people with us on this mission which is why we have committed to putting even tougher protections and safeguards in place and stepping up communications through a public information campaign before the new programme begins.

“Data is only shared where there is a clear benefit to healthcare planning and research, this benefits all of us, but it is only as good as the data it is based upon which is why it is absolutely vital that people make an informed decision about whether to share their data.”

NHS Digital also commented that the respondents to the Which? survey were not made aware of the existing ways in which the NHS collects and uses data, nor of the safeguards in the new system for collecting this data, including that the whole GP records are not shared, that any data would be de-identified before it leaves the GP surgery, data will not leave the Trusted Research Environment and that there is rigorous independent oversight from the Independent Group Advising on the Release of Data (IGARD) and from the GP Profession Advisory Group.

Additional information

NHS Digital press release on 19 July:
New plans to increase protection and strengthen security for GP data collection programme

It states that data collection will now only begin when the following criteria have been met:

  • The ability for patients to opt out or back in to sharing their GP data with NHS Digital, with data being deleted even if it has been uploaded, and outstanding opt outs being processed.

  • A Trusted Research Environment is available where approved researchers can work securely on de-identified patient data which does not leave the environment, offering further protections and privacy while enabling collaboration amongst trusted researchers to further benefit patients.

  • A campaign of engagement and communication has increased public awareness of the programme, explaining how data is used and patient choices

For information on the scheme visit:

There are two ways you can opt out of the scheme. 

NHS Digital has now said people will have the ability to opt-out of the scheme even after it’s started, in which case your data will be deleted even if it’s already been uploaded. You can also opt back in after it’s started.

Type 1 opt out

  • To register for a type 1 opt-out, you have to fill out a form and email or post it to your GP.

  • Type 1 opt-outs have been around since 2013, and if you already registered a Type 1 opt-out back then, it’ll still be in place for this scheme and your data won’t be collected.

  • However, NHS Digital says the Type 1 opt-out might be discontinued in the future and replaced with a new process (below) – so if you’re wanting to opt-out, it’s best to do this as well.

National Data opt-out

  • This is the main way to opt-out of sharing your data under the new GPDPR scheme.

  • It’s done through an online form, where you complete a few basic details (name, date of birth and NHS number) and are then sent a security code via text or email.

  • It’s then just a matter of selecting yes or no to the data sharing scheme.

  • Finding the form involves clicking through a number of NHS web pages.

  • It isn’t clearly labelled as an opt-out form, either (the page is called ‘make your choice’).

  • You can also opt out via phone, email or letter.

  • NHS Digital told us that it was working on making the opt-out process simpler and reviewing the user journey, particularly for Type 1 opt-outs.

About Which?

Which? is the UK’s consumer champion, here to make life simpler, fairer and safer for everyone. Our research gets to the heart of consumer issues, our advice is impartial, and our rigorous product tests lead to expert recommendations. We’re the independent consumer voice that influences politicians and lawmakers, investigates, holds businesses to account and makes change happen. As an organisation we’re not for profit and all for making consumers more powerful.

The information in this press release is for editorial use by journalists and media outlets only. Any business seeking to reproduce information in this release should contact the Which? Endorsement Scheme team at

Press Release