The extra work created by General Data Protection Regulation (GDPR) has been disproportionately high for GPs and needs to be addressed, according to a review commissioned by the UK Government and chaired independently by GP Nigel Watson.

The GP Partnership Review, released today, suggests that the Clinical Commissioning Group (CCG) should fund data protection officers to help strained practices to deal with the extra workload created by data requests from patients.

Under GDPR, which took effect in May last year, GPs are required to comply with data requests within one month. Furthermore, GPs are prohibited from charging patients or solicitors for a copy of health records.

Recommended: NHS Digital CISO Resigns After Three Months

It is mandatory that GPs designate a data protection officer to supervise compliance and act as a point of contact for patients making data requests. These officers can be appointed from within the practice, shared with another practice or appointed by CCGs or health boards.

According to the review: “This burden should be recognised and supported, which could include the provision of resources such as a data protection officer by CCGs.”

At the beginning of the year, media and sport minister Margot James ruled against exempting GPs from GDPR so as to enable them to charge a nominal fee for patient data requests. James said allowing GPs to charge would weaken the rights of patients.

Watson highlighted that GDPR was having a ‘disproportionate impact’ on GPs when compared to small businesses that are able to pass the costs onto their customers.

He said: “Many have a full-time person photocopying or printing out notes for patients or solicitors asking for subject access requests. So the cost to practices – now they can’t charge – is quite significant and is being borne by practices.

“We are suggesting the NHS or Government needs to take recognition of that. This has a financial impact on general practice. And, therefore, there needs to be some resource to go with it.”

Dr Paul Cundy, GPC IT lead, said: “I think every little helps…I would have worries about CCGs having the competence to provide data protection officers but direct reimbursement of practice-provided data protection time would be welcomed.”

In contrast to the rest of the UK, the Scottish Government announced that GPs in Scotland would have data officers provided for them at no cost by health boards.