How we use your data

See how your data is being used to benefit medical research

Read more about how CPRD has used anonymised data for patient and public benefit. 

The importance of medical records to improving public health

Research is important to the NHS and benefits us all, whether we are fit and healthy or suffering from an illness or condition. Research helps us to understand the cause of disease, prevent us from becoming ill, develop safe treatments and improve the health care we receive.

Whenever you visit your doctor or use an NHS service, your electronic health record is updated. This record contains important information about your health and describes the care that you have received. This information in health records is vital for medical research.

For 30 years, GP practices across the UK have contributed information in patient records to CPRD to support medical research to improve patient and public health including:

  • Answering important questions about what causes illness and how to prevent and treat it
  • Monitoring the safety of vaccines and medicines
  • Understanding possible side effects of treatments in patients

CPRD is an official suppoter of Understanding Patient Data, an initiative to support better conversations about the uses of health information. Its aim is to explain how and why data can be used for care and research, what’s allowed and what’s not, and how personal information is kept safe. It works with patients, charities and healthcare professionals to champion responsible uses of data. Its website has more information about how and why data is vital for your individual care, and to improve health, care and services across the NHS.  

Protecting your identity and confidentiality

Your information is protected in the following ways:

  • You cannot be identified from the information sent to CPRD from GP practices. CPRD never receives any personal identifying details from your GP such as your name, address, NHS number or date of birth
  • CPRD only provides anonymised health data to researchers
  • Data can only be used for research to improve patient and public health
  • All research applications must be reviewed and approved by an expert independent scientific committee
  • CPRD is reviewed each year* to make sure its services meet ethical and legal requirements
  • Data is held securely by CPRD and researchers must follow strict terms and conditions when carrying out any research

Find out more on our Safeguarding Patient Data page

Privacy Notice

The Clinical Practice Research Datalink (CPRD) is a centre of the Medicines and Healthcare products Regulatory Agency (MHRA), an executive agency of the Department of Health & Social Care (DHSC), which regulates medicines, medical devices and blood components for transfusion in the UK. The DHSC is the legal ‘controller’ of the data which we hold. You may contact the Data Protection Officer at:

Data Protection Officer
1st Floor North
39 Victoria Street

or at

This rest of this statement covers only the medical research data which CPRD holds. Other more administrative forms of personal data (e.g. on staff, public enquiries, emails, etc.) will be covered under transparency notices of our parent bodies, MHRA and DHSC.

You may also wish to look at the Understanding Patient Data website for more general information about research use of medical data.

What data we hold and why

Observational Research

We hold de-identified information derived from general practice (GP) records so that we can support medical research and the monitoring of the effectiveness and safety of medical drugs and devices. This information may be supplemented with related information from other national sources for particular studies:

  • Death registration data from the Office of National Statistics (ONS)
  • Cancer data from Public Health England (PHE)
  • Hospital Episode data from NHS Digital (A&E, In-patient, and Out-patient)
  • Other data-sets as needed for particular studies, e.g. air pollution data, social deprivation indices

Clinical Research

CPRD-supported clinical research involves patient participation where patients have been invited by their doctor and have consented to take part in a particular clinical study. We only hold medical information specific to that study and we do not know who the patients are.

All clinical studies require approval by a Research Ethics Committee.

The legal bases for processing this information

We do not hold or process personal data on patients; however, NHS Digital (formally the Health and Social Care Centre) may process ‘personal data’ for us as an accredited ‘safe haven’ or ‘trusted third-party’ within the NHS when linking GP data with data from other sources. The legal bases for processing this data are:

  • Medicines and medical device monitoring: Article 6(e) and Article 9(2)(i) - public interest in the area of public health
  • Medical research and statistics: Article 6(e) and Article 9(2)(j) - public interest and scientific research purposes

Any data we hold or pass on to bona fide researchers, except for clinical research studies, will have been anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. We will hold data indefinitely for the benefit of future research, but studies will normally only hold the data we release to them for twelve months.

Your data subject rights under the General Data Protection Regulation (GDPR)

With effect from 25 May 2018, the General Data Protection Regulation comes into force in the UK and this provides for a number of data rights for individuals:

  • the right to be informed about the processing of any data about you (which is what this notice is intended to cover);
  • the right of access to see or receive a printed copy of any personal data relating to you;
  • the right to rectification – to correct any material errors in the personal data we may hold about you;
  • the right to erasure – where appropriate, to ask that all personal data about you is erased;
  • the right to restrict processing – to ask that some or all processing ceases – generally this would involve invoking the National Data Opt-out through your GP or withdrawing from a clinical research study directly;
  • the right to data portability – this only applies to data you have provided directly;
  • the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.

As the data we hold is anonymous, we are not required to support these rights nor is it possible as we have no indication of anyone’s identity. If you are involved in any clinical research studies, then you would have been approached to participate by your GP, who will hold records about your involvement – we do not hold information that identifies you.

You may make a complaint to the Information Commissioner’s Office through their website or their helpline 0303 123 1113.

You can opt out

You can opt out of any confidential information from your health records being used for planning and research. If you do not want your GP practice to share such information from your health record, let your doctor know. Opting out of sharing your health records will not affect the direct care that you receive, though may affect how well the NHS can operate (see below). You can find out more about the National Data Opt-out.

CPRD operates in compliance with the National Data Opt-out Policy.

Researchers and government regulators depend on the data collected by CPRD to safeguard public health and monitor drug safety. If large numbers of patients or particular types of patients choose not to share anonymised health information for research, the information in CPRD will not truly represent the UK population. This situation may lead to unreliable evidence from research aimed at answering important public health questions.



[Page last reviewed 10 July 2018]