General Data Protection Regulation (GDPR)

The GDPR is the EU's General Data Protection Regulation - effective from 25th May 2018 - bringing a number of changes affecting how organisations store data.  The GDPR and Data Protection Act 2018 replace the provisions of the Data Protection Act 1998 and continue in place after the UK exit from the EU.  The GDPR is designed to strengthen and unify data protection for all individuals within the EU and determines how your personal data is processed and kept safe, and the legal rights you have in relation to your own data.

Please see the following links for further information:


Surgery Privacy Notice for Patients:

These privacy notices explains why Wootton Medical Centre collects information about you and how that information may be used.

As Data Controllers, GPs have fair processing responsibilities.  We will ensure that patients are informed about how the information we hold is processed and shared.  All information will be processed lawfully and fairly, in accordance with the Data Protection Act 2018.  Our Privacy Notice explains why we collect information about you and how that information may be used to deliver your direct care and manage the local health and social care system.

The notice reflects:

  • What information we collect about you;
  • How and why we use that information;
  • How we retain your information and keep it secure;
  • Who we share your information with and why we do this.

The notice also explains your rights in relation to consent to use your information, the right to control who can see your data and how to seek advice and support if you feel that your information has not been used properly.

Accessing your Medical Records:

In accordance with the GDPR, patients (referred to as data subjects) have the right to access their medical records held by WMC, this is commonly known as a data subject access request (DSAR).

Please look at the attached information and DSAR form:

Please note - due to covid-19 service pressures, your subject access request (SAR) will be delayed for up to three months (you will be advised once request received) as the surgery are applying the extension to the SAR relevant period as specified in section 54(2) o the Data Protection Act 2018.

Thank you for your understanding during this unprecedented time.

Changes to our Policy:

We regularly review our privacy policy and any updates will be published on our website and posters around the surgery to reflect the changes.


If you have any questions about our privacy policy or the information we hold about you, please contact the Practice Manager via email at or by telephoning 01604 709922.