GPs reporting 'scandalous' extra costs and workload under new GDPR rules

Over half of GP practices have seen an increase in subject access requests (SARs) since the GDPR was introduced - and many are spending over seven hours a week dealing with them.

Practices have to check records for any third party information (Photo:

Under the new EU-wide regulations, practices are no longer able to charge for SARs which means they are facing a significant increase in costs as well as workload.

In a survey of 237 GPs and practice managers by GPonline and its sister site Medeconomics, 57% said that their practice had seen a rise in the number of SARs since the GDPR came into force in May.

One GP respondent said: ‘A solicitor would charge £200 per hour yet we have to do it for nothing. It is scandalous!’

The GPC said it would be pushing for additional funding in contract negotiations to cover the costs practices are incurring because of the GDPR.

SARs cover requests for access to records by patients, or by third parties who have been authorised to have access by the patient, for example solicitors. Before the new regulations came into effect the BMA recommended that practices could charge up to £50 for providing a hard copy of records to patients, or up to £10 for computerised records. Some practices would charge more than this for solicitor requests.

Subject access requests

Producing the information required by a SAR can involve significant work for practices because they need to check each record to ensure they are not unwittingly providing details about any third parties.

On average, respondents to the GPonline/Medeconomics survey said their practice received seven SARs a week – although some received many more than this. The majority (62%) said it took them longer than 30 minutes to process a single subject access request, with 18% saying it took longer than an hour. Only 8% said it took less than 15 minutes to process SARs, while 30% said it took between 15 and 30 minutes.

The results suggest that some practices are spending at least seven hours of a staff member’s time a week processing SARs – for which they receive no funding. Practices also incur costs related to photocopying, printing and postage if the patient requests a hard copy of their record.

Guidance for GPs on the GDPR published by NHS Digital’s Information Governance Alliance earlier this year said that the changed process on subject access requests would ‘not be a burden on the practice’ if they provided patients with online access to records. However, even in these scenarios someone in the practice would need to check a patient’s record to ensure that third party information is redacted before making it available online.  

Increased workload

GPs responding to the poll said that the increase in workload was taking time away from patient care and that practices should be paid for the work involved.

‘It is a huge workload checking for third party information, particularly for patients with a lot of notes,’ one GP said.

‘The GDPR is actively costing us money as we pay for all the paper, toner, postage as well as staff time,’ another said.

‘We should be paid for the work involved in providing copies of records. It can take a considerable time for which we have to pay our staff,’ said another.

‘The charges before the GDPR didn’t cover the costs, so now that it has to be provided free of charge it is a huge drain on resources,’ one GP said.

GPC chair Dr Richard Vautrey said: 'We know from our own members that they are concerned about the increase in SARs since the GDPR legislation came in, and the knock-on effect on both workload and practice finances.

'The BMA has produced guidance for GPs and their teams on this issue and will be pushing for additional funding to help cover the cost of any increase in negotiations.'

A motion for debate at Scotland’s LMCs conference, which takes place this Friday, is also calling on the Scottish GPC to negotiate extra funding to cover the cost of the work involved in responding to patient SARs.

Read more
For more advice on the GDPR and what it means for practices, Medeconomics subscribers can access information and resources here.

Have you registered with us yet?

Register now to enjoy more articles and free email bulletins


Already registered?

Sign in

Just published

Hospital entrance

NHS England issues warning over norovirus and rising winter pressures

Almost three times as many people were in hospital with norovirus last week compared...

BMA Northern Ireland GP committee chair Dr Alan Stout

Northern Ireland GPs face deepest-ever crisis as practices hand back contracts

Northern Ireland's GP leader has warned that general practice in the region is facing...

GP consulting room

GP appointments hit record high of over 34m in October

GP practices delivered a record 34.3m appointments in October this year excluding...

GP consultation

New contract that enforces continuity would make GPs and patients safer, says watchdog

A new GP contract that makes continuity of care an 'essential requirement' for practices...

GP receptionist on the phone

Some practices to receive funding to upgrade digital phone systems

GP practices whose digital phone systems do not meet new NHS England standards will...

Woman using mobile phone

Safety issues with remote GP consultations 'extremely rare', study shows

Safety incidents are 'extremely rare' in remote GP consultations but risk is higher...