DSPT 2026-27 · Standard 1: Personal Confidential Data
Have you reviewed how your practice asks for and records patient consent to share personal data?
Why it matters for your practice
This is about checking your processes for getting patient consent when sharing their information — for example, sharing records with a carer or family member, or for mailing lists. Note: most clinical data sharing (e.g. referrals, prescriptions) doesn't rely on consent but on other legal bases. This question is about the specific cases where consent IS needed.
Is it mandatory?
No. 1.1.6 is optional for GP practices in the 2026-27 DSPT, but answering it shows good practice.
Official wording from NHS England
Assertion 1.1: The organisation has a framework in place to support Lawfulness, Fairness and Transparency
Your organisation has reviewed how it asks for and records consent to share personal data.
Generally, consent under data protection law is not appropriate in health and care settings, but there are some circumstances where it may be necessary, such as for mailing lists. Further guidance on consent under data protection legislation is available on the ICO website (https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent). Consent under the common law duty of confidentiality, however, is more frequently applicable. For example, an individual must provide their consent to share information with their carer. Provide details on your processes for gaining this consent in the comments.
Official wording © NHS England, from the DSPT 2026-27 (v9) requirements. Always check the live Data Security and Protection Toolkit before you submit.
ClinicShield templates that help
- Data Protection Policy
Ready-to-edit templates are included in paid plans.