Data Use and Access Act 2025: Guidance for GP Practices

New guidance for GP practices on Data Use and Access Act 2025, including June 2026 data protection complaints requirements and practical compliance steps.

Date published:
Date last updated:
Next review date:

The Data Use and Access Act 2025 is now law and we provided a news update last year. While much of the focus has been on AI, digital identity and wider system changes, the Act also has practical implications for general practice, particularly in how patient data is used, shared and governed.

This page brings together the key points for practices and reflects the latest position following implementation of further provisions in June 2026.

Update June 2026: Data protection complaint handling

From 19 June 2026, additional provisions come into force requiring all organisations, including GP practices, to have a clear process for handling data protection complaints. This establishes a formal expectation that practices resolve data protection concerns locally, using a clear and documented process.

In summary, practices must:

  • provide a clear way for patients to raise a data protection complaint
  • acknowledge receipt within 30 days
  • investigate and respond without undue delay, keeping the patient informed
  • inform the patient of the outcome

This reflects a tightening of governance expectations rather than a fundamental change to how practices use or share patient data. For most practices, this will be met by reviewing and refining existing processes rather than introducing new systems.

In practical terms, this is likely to mean:

  • ensuring complaints policies explicitly include data protection complaints
  • providing clear information to patients on how to raise concerns
  • maintaining a simple record of complaints and outcomes
  • ensuring staff recognise and escalate data-related concerns appropriately

What practices should do now

A proportionate approach is recommended.

Practices should:

  • review complaints procedures to ensure data protection complaints are included
  • check that patients can easily find out how to raise concerns about their data
  • confirm there is a simple process for logging and responding to complaints
  • ensure staff understand how to recognise and escalate data-related complaints

For most practices, this is a light-touch governance update rather than a major operational change.

Key points for practices

The Act gives Government new powers to enforce national information standards. For the first time, IT suppliers, including GP clinical system providers, will be legally required to comply. This is intended to improve interoperability between systems and support development of a single NHS patient record, including access via the NHS App. Practices are not expected to implement new standards directly at this stage, but future system changes are likely as suppliers are required to comply.

The free flow of data between the UK and EU remains important for research and public health. Some concerns were raised during the passage of the Act, although the most controversial elements were removed. The position continues to evolve and may be kept under review.

The Act does not change core protections around patient data confidentiality or who can access NHS data. Ministers have stated that NHS data is not for sale. However, the Act continues to highlight the importance of transparency and public confidence, particularly around secondary uses of health data and research access.

There are no immediate changes to how practices collect, store or share patient data in routine care. The Act does not replace UK GDPR or the Data Protection Act 2018. Instead, it makes targeted changes within the existing legal framework.

The Act introduces a new lawful basis for processing in certain defined circumstances. In practice, this provides greater clarity when responding to requests from other public bodies. For example, where a statutory body such as the police, a local authority or an NHS organisation states that it requires information to carry out its functions, practices can rely on that confirmation provided that:

  • the request is genuine
  • it is clear what is being asked for
  • only the minimum necessary information is shared
  • the rationale is recorded

This does not remove the need for professional judgement, but it reduces uncertainty about the lawful basis.

The Act explicitly reinforces lawful data sharing for safeguarding purposes, including protecting children and vulnerable adults. This reflects existing expectations and should already form part of routine practice.

The Act sits within a wider programme of digital and data reform across the NHS.

Practices may see increasing discussion about:

  • access to de-identified GP data for research
  • development of national data infrastructure
  • expanded use of digital tools and data sharing

These developments will continue to require careful attention to governance, transparency and patient trust.

LMC view

The Act represents a continuation of the existing direction of travel in data protection and NHS digital policy.

The June 2026 complaints provisions introduce a clearer expectation that organisations resolve concerns locally, supported by defined processes and timelines.

Practices should ensure their arrangements are clear, accessible and documented, but this should be achievable through refinement of existing processes rather than significant new workload.

Further guidance