Skip to main content

National Data Sharing Arrangement for GP Connect

The GP Connect National Data Sharing Arrangement (NDSA) sets out the data sharing requirements and obligations for the use of GP Connect. This ratifies the safe sharing of clinical information through GP Connect to support direct patient care.

New GP Connect users

  1. You should only apply if your system supplier has referred you to us because you use GP Connect for one of the agreed reasons.  
  2. Read below Step 1: Before you apply.
  3. Review the current version through the NDSA sign-up portal and ensure you satisfy steps 1 to 3 outlined below.

Existing GP Connect users

Users who are already using GP Connect, do not need to re-sign the NDSA.

How to tell if you’re an existing user: 

Look up on our transparency portal to check which organisations are using GP Connect.


Step 1: Before you apply

  1. You should hold a current (valid) Data Security and Protection Toolkit (DSPT) for the ODS code you are using to apply to the NDSA.
  2. Read and review the NDSA and ‘Agree’ that you may be subject to audits from NHS England.
  3. You will be asked to confirm that your organisation can meet the obligations of the NDSA and Acceptable Use Policy.
  4. Failure to comply with the above will cause your application to be rejected.

Step 2: Application

  1. GP Connect will confirm whether your application has been successful.
  2. Email your system supplier to progress your application to get your product live and raise any queries you may have.

Step 3: Next steps

  1. Update your transparency notices to include ‘GP Connect’. Use our transparency notice and privacy notice for guidance.
  2. Organise your product training with your system supplier.
  3. Cascade any information on consent options to relevant staff.
  4. Ensure that you know how to provide data subjects with an audit trail of access to their records upon request.

Reasons currently supported by the NDSA

Urgent and emergency care - 111 and 999 paramedics and call centres using Access Record: HTML and Appointment Management, so that records can be viewed in an emergency and appointments can be booked into GP practices where appropriate.

Social care - care homes/nursing homes and hospices using Access Record: HTML.

Shared Care Records - access to primary and secondary care settings using the Shared Care Record with GP Connect enabled. There will be additional local governance arrangements to support these records.

GP practice - the practice where patients are registered and other practices where the patient may attend if they see a doctor when they are away from home. 

Health Care Trust - hospitals including mental health hospitals. If patients attend A&E or other department for care the clinician may need to view their GP record for a more detailed history.

Primary Care - GP hubs/primary care networks (PCNs)/integrated care systems (ICSs), partnerships between healthcare providers and local authorities.

Pharmacy - pharmacies that support additional prescribing and other pharmacy services.

Optometry - optometrists working in a range of specialist eyecare fields.

Important

All GP Connect users have actions to take to satisfy the NDSA. These are explained in ’Steps 1-3’ above.


Supporting information

Legal basis

The legal basis for GP Connect is Article 6(1)(e) and Article 9(2)(h) of the UK GDPR (General Data Protection Regulation). For Common Law Duty of Confidentiality, implied consent with opt out is used.

The legal basis is driven by parliamentary law, and NHS policy is driven by NHS England, the Department of Health and Social Care, and national stakeholders.

Medical examiners use case
Healthcare providers are legally obliged to provide medical examiners with medical records relating to deceased individuals for the purposes of reviewing a death. As these individuals are deceased, they are not covered by UK GDPR - however, there are still obligations under the Common Law Duty of Confidentiality. 

Medical examiners have a legal right to access the records of deceased patients and there is a legal obligation for healthcare providers to provide the records to medical examiners under the Access to Health Records Act 1990. As such, the duty of confidentiality is overridden.

Transparency notice
Products covered by the NDSA

Find out which products are covered by the NDSA in the GP Connect transparency notice.

Accession to the NDSA

If you are already using GP Connect you do not need to sign the NDSA, but you can review the current version through the NDSA sign-up portal. Read about accession to the NDSA.

Endorsements

The NDSA is endorsed by key stakeholders, including the Information Commissioner's Office (ICO), National Data Guardian (NDG), the Royal College of General Practitioners (RCGP), and the British Medical Association (BMA). 

Version notes

The current version of the arrangement now supports private health care providers and pharmacy to use GP Connect. Updates to the NDSA are described in the version notes

Last edited: 10 July 2025 5:14 pm