United Kingdom · UK GDPR · Data Protection Act 2018 · NHS Code of Practice 2021
UK GDPR, the serious-harm test, and the NHS schedule.
After leaving the European Union the United Kingdom kept GDPR almost unchanged and calls it UK GDPR. So most of what applies here is the same as in the EU, and the GDPR page covers that shared ground: lawful basis, access, erasure, portability and the governance records.
What this page covers is what is different. The Data Protection Act 2018 adds health-specific rules that the EU regulation does not have, the NHS sets retention periods that the EU leaves to each country, and there is a right over the records of people who have died that GDPR does not reach at all. For a mental-health service those differences are not small.
Withholding a record from the person it is about
Schedule 3, Part 2 of the Data Protection Act 2018 allows health data to be withheld from a person's own access request, to the extent that releasing it would be likely to cause serious harm to the physical or mental health of anyone. In a mental-health service this is the closest thing the UK has to the American psychotherapy-notes carve-out, and it is used for real reasons: a record that names a third party at risk, or one whose disclosure at the wrong moment would harm the person themselves.
It is also a serious power, and the Act is procedurally strict about it. The opinion has to come from an appropriate health professional involved in that person's care, and it has to have been given within the previous six months. Built as a checkbox, that becomes a flag somebody set in 2023 that nobody has looked at since. So it is built as a workflow that expires on its own.
What the system requires
Before a decision can exist at all
- A named professionalThe decision records who took it, not just that it was taken.
- A current care relationshipOnly someone holding a live relationship with that person may take the decision. The system checks this rather than trusting it.
- Reasoning in their own wordsNot a dropdown. The professional writes why, and that text is the record.
- The specific documentsThe decision covers named documents, not a whole file or a whole person.
What the system does afterwards
Which is where a checkbox would fail
- It expires after six monthsAutomatically, matching the Act's own six-month window on the professional opinion. Nothing depends on anyone remembering.
- It appears in a review queue firstA scheduled job surfaces decisions approaching expiry, so a still-valid one can be renewed deliberately.
- Lifting it restores the previous labelNot "normal". A document that was sensitive before the decision is sensitive again after it, rather than being quietly downgraded.
- The care team still sees the documentWithholding is from the person, not from the clinicians treating them. That is the point of withholding rather than deleting.
- The access log records it as its own eventSo the history shows what was withheld, from whom, when and by whose decision.
The commonest failure with withholding is not making a wrong decision. It is making a right decision and then never revisiting it, so that material stays hidden from someone years after the reason has gone. The Act's six-month window exists to prevent exactly that, and a system that stores the decision as a permanent flag quietly defeats it. Expiry by default puts the burden on renewing a restriction rather than on remembering to lift one.
How long records are kept, and what the periods count from
The NHS Records Management Code of Practice 2021 sets retention periods for health records. It binds NHS organisations and services contracted to deliver NHS care. A private clinic sets its own policy — but adopting the NHS schedule is the safe default, because shortening a retention period later is straightforward and discovering you disposed of something you needed is not.
The four rules below ship as data, ready to use. Each counts from a stored anchor date, which is the part most retention schedules get wrong: a period expressed in years is meaningless without something to count from, and "when the file was created" is almost never the right answer.
| Record type | Period | Counted from, and why |
|---|---|---|
| Mental-health records | 20 years | From the date of last contact with the service. This is the longest period in the project and it is what the retention engine was designed around — a system that cannot hold a record correctly for twenty years cannot serve a mental-health practice at all. |
| After death | 10 years | From the date of death. This is why date of death is stored as a retention anchor in its own right rather than being treated as an end to the relationship. |
| Adult general records | 8 years | From last contact. Applies to the non-mental-health material a practice accumulates alongside the clinical file. |
| Children's records | To age 25 | From date of birth, which is why date of birth is an anchor too. A period that ends at a birthday cannot be computed from anything else. |
The encryption key for that record is destroyed — the secure documents page covers the mechanism and its limits. The content becomes permanently unreadable while the empty shell and the audit trail remain, so you can prove the record existed and was disposed of on schedule. Nothing is destroyed while a legal hold stands. And because disposal runs as a scheduled job, somebody has to confirm it is still running — a retention job that quietly stops is a problem that only surfaces in an audit.
A right GDPR does not reach
GDPR protects living people. It says nothing about the records of someone who has died, which leaves a gap the United Kingdom fills with its own legislation. The Access to Health Records Act 1990 allows a personal representative of the deceased, or someone with a claim arising from the death, to ask for their records.
That is a genuinely different kind of request, and treating it as an ordinary access request creates a real risk. The applicant is not the subject. Their entitlement rests on their standing — being the executor, or having a claim — and that standing has to be established and recorded rather than assumed from the fact that they are family. A sibling is not automatically entitled; an executor is.
| Aspect | Status | How it is handled |
|---|---|---|
| A separate kind of request | ✓ | Recorded as its own request type rather than folded into the subject access route, because the applicant, the entitlement and the grounds for refusal are all different. |
| The applicant's standing | ✓ | Captured on the request. Who is asking, and on what basis they are entitled to ask. |
| Date of death as a retention anchor | ✓ | Stored, so the ten-year period after death is computed rather than estimated, and so the record still exists when a request arrives years later. |
| Grounds for refusal | ◐ | Built: a refusal is recorded, with the reasoning written out and attributed.
What remains: the Act's own grounds — material the deceased expected to stay confidential, and information identifying a third party — are not offered as separate options to pick from. Somebody has to know the grounds and write which one applied, rather than choosing it from a list the way they can on a HIPAA denial. |
The principle that says blocking everything is also a failure
UK health information governance runs on the Caldicott Principles, overseen in each organisation by a Caldicott Guardian. Most of them are what you would expect: justify the purpose, use the minimum necessary, access on a need-to-know basis, be aware of your responsibilities, comply with the law.
Principle 7 is the one that changes system design. It says the duty to share information can be as important as the duty to protect patient confidentiality. A system built only to refuse is not a safe system — it is one where a clinician facing a crisis at two in the morning cannot reach what they need, and where the workaround becomes a phone call and a note on paper that nobody logs.
That principle is why emergency access is a designed feature of this platform rather than a hole left in it. A clinician can reach a record they have no relationship with, in a genuine emergency, by opening a break-glass session. It is recorded as an event and reviewed afterwards. The access is available; the use of it is never silent. Those two properties together are what makes it defensible under Principle 7 and under UK GDPR at the same time.
What is not built on the UK side
The UK module is the smallest of the three, because most of what the UK needs is inherited from GDPR. That means its remaining gaps are mostly the specifically British ones.
Still open
- Access to Health Records Act refusal grounds are free text. The Act has its own grounds for refusing — material the deceased expected to remain confidential, and information identifying a third party. The refusal and its reasoning are recorded, but those grounds are not modelled as separate options you pick from.
- No Caldicott Guardian record. The role is required in NHS organisations and expected in services delivering NHS care. The US security official and privacy official have designations in the system; the Caldicott Guardian does not, so the appointment lives outside it.
- National Data Opt-Out is not implemented. If you use data for purposes beyond direct care, patients may opt out of that use nationally, and honouring it is a requirement for NHS-facing services. Nothing in the product tracks or applies it.
- The Data Security and Protection Toolkit is out of scope. NHS-facing organisations complete it annually. It assesses your organisation rather than this software, and no part of the product carries it.
- Encrypted documents cannot be searched by content. A direct consequence of the encryption. Documents are found by subject, type and date.
Built, but only worth what you do with it
- The withholding review queue has to be worked. Decisions surface before they expire so a still-valid one can be renewed deliberately. If nobody reads the queue, valid decisions lapse and material becomes visible that a clinician judged it should not be.
- Break-glass records have to be reviewed. Every emergency access is recorded. The control is the review, not the recording.
- Retention has to be confirmed as running. The NHS periods ship as data, and disposal runs on a schedule. A retention job that stops quietly is a governance failure that only appears in an audit years later.
What stays with your organisation
Not legal advice, and no product is certified
The ICO does not certify software as UK GDPR compliant. This page describes the technical and organisational measures the platform provides. Confirm every item with UK counsel or your information governance lead before it reaches a contract.
- You are the controller. The purposes and means of processing are yours to decide.
- Data processing agreements with any processor you connect, and the sub-processor terms that come with them.
- Appointing a Caldicott Guardian and, where required, a data protection officer, and publishing how people reach them.
- Deciding your own retention policy if you are a private clinic. Adopting the NHS schedule is a defensible default, but it is a decision you make and record.
- Completing the Data Security and Protection Toolkit if you deliver NHS care.
- Who gets a care relationship, and the training and supervision behind that.
- Reviewing break-glass use. The system records every emergency access. Somebody has to read those records and act on what they show.
- Watching the scheduled jobs, including the retention runs and the withholding review queue. A job that stops quietly is a governance failure that only appears later.
UK GDPR is GDPR, so the lawful basis, access, erasure, portability and governance work described on the European page apply here unchanged. On top of that, the serious-harm test is built as a workflow that requires a named professional with a current care relationship, records their reasoning, surfaces for review and expires by itself at six months. The NHS retention schedule ships as data, including the twenty-year mental-health period the retention engine was designed around. Records of the deceased are handled as their own kind of request, because the applicant is not the subject, and breach notification to the ICO runs on the shared breach record. What is missing is the Act's specific refusal grounds as pickable options, a record for the Caldicott Guardian appointment, and the National Data Opt-Out.