The Clinical Practice Research Datalink (CPRD) is a centre of the Medicines and Healthcare products Regulatory Agency (MHRA), an executive agency of the Department of Health & Social Care (DHSC), which regulates medicines, medical devices and blood components for transfusion in the UK. The DHSC is the legal ‘controller’ of the data which we hold. You may contact the Data Protection Officer at:
Data Protection Officer
1st Floor North
39 Victoria Street
The rest of this statement covers only the medical research data which CPRD holds. Other more administrative forms of personal data (e.g. on staff, public enquiries, emails, etc.) will be covered under transparency notices of our parent bodies, MHRA and DHSC.
You may also wish to look at the Understanding Patient Data website for more general information about research use of medical data.
What data we hold and why
We hold de-identified information derived from general practice (GP) records so that we can support medical research and the monitoring of the effectiveness and safety of medical drugs and devices. This information may be supplemented with related information from other national and regional sources for particular studies:
- Death registration data from the Office of National Statistics (ONS)
- Cancer data from Public Health England (PHE)
- Hospital Episode data from NHS Digital and regional hospital trusts (accident and emergency, In-patient admissions and Out-patient appointments including information on prescriptions, procedures and other clinical investigations)
- Clinical audit data from organisations such as the Health Quality Improvement Partnership (HQIP)
- Specialist secondary care services like adult mental health services and maternity services
- Quality of life measures and patient reported outcomes from PHE and NHS Digital
- Disease registry data for e.g. kidney disease, joints register
- Screening data for e.g. diabetic eye disease screening
- Medicines dispensing data
- Maternity and children’s services data from hospital and community services
- Other data-sets as needed for particular studies, e.g. air pollution data, social deprivation indices
Patient-consented clinical research
CPRD supports clinical research involving patient participation where patients have been invited by their doctor and have consented to take part in a particular clinical study. We only hold medical information specific to that study and we do not know who the patients are.
All clinical studies require approval by a Research Ethics Committee.
The legal bases for processing this information
We do not hold or process personal data on patients; however, NHS Digital (formally the Health and Social Care Centre) may process ‘personal data’ for us as an accredited ‘safe haven’ or ‘trusted third-party’ within the NHS when linking GP data with data from other sources. The legal bases for processing this data are:
- Medicines and medical device monitoring: Article 6(e) and Article 9(2)(i) - public interest in the area of public health
- Medical research and statistics: Article 6(e) and Article 9(2)(j) - public interest and scientific research purposes
Any data we hold or pass on to bona fide researchers for observational research will have been anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. We will hold data indefinitely for the benefit of future research, but studies will normally only hold the data we release to them for twelve months.
Your data subject rights under the General Data Protection Regulation (GDPR)
With effect from 25 May 2018, the General Data Protection Regulation came into force in the UK and this provides for a number of data rights for individuals:
- the right to be informed about the processing of any data about you (which is what this notice is intended to cover);
- the right of access to see or receive a printed copy of any personal data relating to you;
- the right to rectification – to correct any material errors in the personal data we may hold about you;
- the right to erasure – where appropriate, to ask that all personal data about you is erased;
- the right to restrict processing – to ask that some or all processing ceases – generally this would involve invoking the National Data Opt-out, speaking to your GP or withdrawing from a clinical research study directly;
- the right to data portability – this only applies to data you have provided directly;
- the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.
As the data we hold is anonymised data, we are not required to support these rights nor is it possible as we have no indication of anyone’s identity. If you are involved in any patient-consented clinical research studies, then you would have been approached to participate by your GP, who will hold records about your involvement – we do not hold information that identifies you.
You may make a complaint to the Information Commissioner’s Office through their website or their helpline 0303 123 1113.
You can opt out
You can opt out of any of your patient information being used for planning and research. If you do not want your GP practice to share such information from your health record, let your doctor know. Opting out of sharing your health records will not affect the direct care that you receive, though may affect how well the NHS can operate (see below). You can find out more about the National Data Opt-out in England.
CPRD operates in compliance with the National Data Opt-out Policy for patients in England.
The Government depends on the data collected by CPRD to monitor drug safety and safeguard public health. If large numbers of patients or specific patient groups choose not to share anonymised health information for research, the information in CPRD will not truly represent the UK population. This situation may lead to unreliable evidence from research studies and incorrect answers to important health and safety concerns.