For General Practice Joining Wessex SDE

Your practice is being asked to review the onboarding documents, sign the Data Sharing Agreement, confirm a practice information governance contact, update your privacy notice wording and display patient information materials in patient-facing areas. The Wessex SDE team will support the technical onboarding process and provide the poster, leaflet and wording needed to keep patients informed.

General Practice data gives researchers a fuller picture of people’s health over time. It helps approved studies understand long-term conditions, prevention, health inequalities, medicines, care pathways and what happens before and after hospital care. Used safely alongside hospital, community and other NHS data, it can support better research, service planning and improvements in patient care.

The Wessex SDE is used for approved health research and NHS planning. It is not used to make decisions about an individual patient’s care, make automated decisions about patients, or replace the systems used by General Practices, hospitals or other NHS services.

The use of NHS patient data for research is protected by law and carefully regulated. The Health Research Authority has given Section 251 support to the Wessex SDE, following advice from the Confidentiality Advisory Group. This allows confidential patient information to be used for approved research where it would not be practical to contact every patient individually for consent, provided appropriate safeguards, transparency measures and patient opt-outs are in place.

Data may include information already recorded in NHS patient records, such as diagnoses, medicines, test results, appointments, treatments and demographic information. Some confidential patient information, including name, address, postcode, date of birth and NHS number, may be needed at the start to link records accurately, check data quality, remove duplicate records and apply patient opt-outs. This happens in the SDE’s Data Processing Environment. Researchers never have access to this part of the SDE and never see this identifiable patient information.

Yes. Where it is necessary for an approved research project, GP data may be securely linked with other approved datasets. These may include hospital, community, mental health and relevant national NHS datasets, and in some cases other health or administrative datasets where appropriate approvals are in place.

Data linkage helps researchers understand the bigger picture while ensuring that identifiable information is handled only within the restricted Data Processing Environment. Researchers access only the minimum pseudonymised data needed for their approved project.

No. Researchers never see names, addresses, NHS numbers or other direct identifiers. Identifiable information is only used in the restricted Data Processing Environment by authorised SDE technical staff. Before research access, identifiers are removed or replaced with secure codes, and the data is reduced to the minimum needed for the approved study.

Approved researchers access only the minimum pseudonymised data needed for their approved study. Each project is provided with its own secure, locked-down workspace, ensuring researchers can only access the data approved for that specific research. Researchers cannot download or remove raw patient data. Only checked, anonymised research outputs can leave the secure environment.

General Practices and NHS organisations provide the source data. University Hospital Southampton NHS Foundation Trust hosts Wessex SDE and oversees how data is managed and used.

Other organisations may support extraction, preparation, technical services and infrastructure. These include clinical system suppliers, extraction services, University of Southampton’s Clinical Informatics Research Unit (CIRU), and secure hosting and infrastructure providers. They support the SDE under NHS governance, security and contractual controls, and do not receive any data for their own purposes.

The Wessex SDE uses a secure access model, so patient data stays within the NHS secure research environment rather than being sent to researchers.

Access is controlled through the Five Safes framework, ensuring that only approved people can access the minimum data needed for approved projects, within secure technical environments. Researchers cannot download raw patient data, and all results are checked before they can leave the SDE.

The Wessex SDE also meets recognised information security standards, including ISO/IEC 27001, and complies with NHS information governance and cyber security requirements.

Researchers and their organisations must first be approved through a national accreditation process.

They must then submit a data access request to Wessex SDE. Requests are reviewed by the Wessex Data Access Committee, which includes public and professional representatives. The committee considers whether the research has clear public benefit, whether the data requested is necessary and proportionate, and whether the right safeguards are in place.

Yes. Participating practices are kept informed about how their data is being used.

When a new study is approved to use General Practice data, practices are notified and have 10 working days to tell Wessex SDE if they do not want their data included in that study.

Patients continue to have choices about how their NHS data is used.

Wessex SDE applies the National Data Opt-out, Type 1 Opt-out, and local Wessex SDE opt-out before data is made available for research.

If a patient opts out after their data has already been included in an approved research dataset, the opt-out will not be applied retrospectively to research that has already taken place. Their choice will apply to future studies.

Yes. Participating practices are expected to display Wessex SDE patient information materials in accessible patient-facing areas, such as reception areas, waiting rooms and leaflet racks. We have posters and digital screen content that you can use. These are provided when you join the Wessex SDE.

These materials explain how data may be used, what safeguards are in place and what choices patients have. Practices should also add the supplied wording to their privacy notice or website.

Approved studies are published in the Wessex SDE Data Use Register.

Information about available datasets is also published through the Wessex Data Capabilities Register and, where appropriate, relevant national data libraries.

Data is only retained for as long as there is a lawful reason to keep it.

Information held within the Wessex SDE is managed in line with Wessex SDE policies and the NHS Records Management Code of Practice. Data is retained, archived or securely destroyed according to the approved purpose and relevant policy.

All activity within the SDE is monitored and auditable. Researchers and organisations must agree to strict terms of use and information governance requirements before access is granted.

Suspected misuse, security incidents or data breaches are investigated through established information governance processes. Where required, incidents are reported to regulators and affected organisations.

The Wessex SDE operates within a framework of NHS governance, independent oversight and external assurance.

All requests to access data are reviewed by the independent Wessex Data Access Committee, which includes both professional experts and public representatives. The Committee considers whether each project has a clear public benefit, appropriate approvals, proportionate data requirements and robust safeguards before access is granted.

Public contributors are also involved throughout Wessex SDE governance, helping shape policies, communications, research scrutiny and the way the service develops.

In addition, the Wessex SDE’s arrangements are supported by review from the Health Research Authority, Confidentiality Advisory Group and, where required, Research Ethics Committees. The SDE and its technical partners are also subject to NHS information governance, security and audit requirements, including the Data Security and Protection Toolkit, ICO registration, ISO/IEC 27001 and Cyber Essentials.

Material changes to purposes, data flows, organisations involved, safeguards, approvals or patient choice arrangements would need to be reviewed through the appropriate governance process.

This may include updates to the DPIA, Data Sharing Agreement, Data Access Committee review, HRA or CAG review, or further patient and public scrutiny.

No. General Practice data remains within the United Kingdom. Only anonymous research outputs may leave the secure environment, and only after review and disclosure checks.