Medical data privacy in the UK: what the law says

What the law says

How United Kingdom treats your health data.

The law: UK GDPR and the Data Protection Act 2018[S105]
The regulator: Information Commissioner's Office (ICO)[S105]
Health data: Health data is a special category under the UK GDPR, processed only on a listed ground, such as your explicit consent or care by health professionals bound by confidentiality.[S105]
Sending it abroad: Data may leave the UK to countries the UK government has found adequate, or under safeguards such as the UK's international data transfer agreement.[S105]
EU adequacy: Yes. The EU renewed its adequacy decisions for the UK in December 2025, valid until December 2031.[S104]
If there is a breach: Within 72 hours to the ICO where feasible, and to the people affected without undue delay when the risk to them is high.[S105]
Fines: Up to GBP 17.5 million or 4% of worldwide annual turnover, whichever is higher.[S105]

Sending your records

The law protects the clinic’s copy. How it gets there is up to you.

Email and messaging apps leave a readable copy on every server they pass through, in United Kingdom and at home. The safest file is the one that stays encrypted on your own phone, shown to the doctor in the room or sent by a link that expires by itself.

Try the free privacy check

Questions

United Kingdom: common questions.

Is it safe to email medical records to a clinic in United Kingdom?

Email is protected between mail servers only when both providers support TLS, and it stays readable on each server afterwards. Once your records reach a clinic in United Kingdom, local law applies: health data is a special category under the UK GDPR, processed only on a listed ground, such as your explicit consent or care by health professionals bound by confidentiality. For a full history, use a channel where you hold the key, such as a link that expires by itself.

How does United Kingdom protect health data?

Health data is a special category under the UK GDPR, processed only on a listed ground, such as your explicit consent or care by health professionals bound by confidentiality. Breaches must be reported within 72 hours to the ICO where feasible, and to the people affected without undue delay when the risk to them is high. The regulator is the Information Commissioner's Office (ICO).

Can a clinic in United Kingdom send my medical records abroad?

Data may leave the UK to countries the UK government has found adequate, or under safeguards such as the UK's international data transfer agreement.

Keep reading

More on United Kingdom, and elsewhere.

Sources are numbered in the text and listed in full in the reference list.

Medical data privacy in United Kingdom.