Privacy and cookies

Registration information

What we hold

We hold information about doctors who are registered with us. We also hold information about doctors who apply for registration, and doctors who are no longer registered.

For registration purposes, we hold information about a doctor’s nationality, qualifications, employment history, and other relevant evidence of entitlement to registration. 

We hold data about a doctor’s health and criminal convictions if they have told us this information as part of their application. When a doctor applies for registration as an international medical graduate, we verify their qualifications and work history. The verification process is carried out for us by an external organisation. They give us confirmation of the verification, or information about any concerns raised through the process. 

If a doctor has done a PLAB assessment, we will hold information about their assessment history and scores. We hold contact information about doctors and, depending on how they pay their annual retention fee, we also hold bank account or credit card information. 

We hold information about fitness to practise incidents that take place while a student is at a UK medical school. This information is provided by students and universities when the student applies for provisional registration.

Why we hold it

We are required under the Medical Act 1983 to maintain a register of doctors, a register of general practitioners and a register of specialist practitioners. We're responsible for making sure doctors on the registers are suitably qualified. 

We hold contact information so we can contact doctors about their registration, annual retention fee payment and fitness to practise investigations. We also contact registered doctors with relevant news, such as new guidance.

How we share it

We're required to make some of this information publicly available on the medical register, and we also provide some organisations with a downloadable version of the public register. We share non-public registration information with relevant third parties, including UK health departments, employers, designated bodies, responsible officers, suitable persons and other bodies where appropriate.

This information includes date of birth, photograph, passport details, registered email address, registered address and whether a doctor is subject to investigation under our fitness to practise procedures. We share this information when it is necessary to assist an organisation with its functions or legitimate interests. 

Fitness to practise investigations and sanctions information

What we hold

We hold information about fitness to practise complaints, investigations of complaints, records of hearings, and records of the outcome of our investigations including sanctions and warnings.

We hold information about patients, including medical records, where it has been provided as part of a complaint or is necessary for our investigation. We have the power to require the disclosure of medical records if necessary.

Why we hold it

We are required under the Medical Act 1983 to investigate fitness to practise concerns.

The Medical Act also requires us to share information about fitness to practise investigations with employers and the Department of Health.

We use doctors’ data in our risk modelling programme to help us identify types of doctor more likely to have fitness to practise issues.

How we share it

Information about hearings and sanctions issued by a tribunal is published on the Medical Practitioners Tribunal Service website. Information about warnings and undertakings issued by case examiners is published on the this website. You can find more information about how we publish fitness to practise information, including relevant time periods, in our publication and disclosure policy.

We disclose tribunal hearing bundles to the Disclosure and Barring Service in line with our duties under the Safeguarding Children and Vulnerable Groups Act 2006.

Each month, we distribute a list of recent sanctions to bodies in the UK and abroad who have a legitimate or statutory interest in this information.

Research

What we hold

The personal data we use to carry out our regulatory functions can also be used for research to support these functions. This includes demographic information, employment and fitness to practise history, and details of complaints.

We obtain further data from third parties to enable research into medical education as part of the UK Medical Education Database (UKMED) project. These data cover individuals who started at a UK medical school since 2007. The data providers include the Higher Education Statistical Authority, medical schools, deaneries and the UK Foundation Programme. More information about the data we hold and how we use it us available on the UKMED website. 

Why we hold it

We conduct and commission research on a range of topics to support our regulatory functions related to registration, fitness to practise, and medical education and training. We generate statistical data based on the information we hold, for example GMC Data Explorer.

Find out more about our research.

How we share it

We share personal data with researchers if necessary. We only share what is needed for the research, using secure methods.

Where possible, we provide researchers with anonymised or pseudonymised data for research purposes. UKMED research data are always pseudonymised.

When we publish research or statistics we apply disclosure controls to make sure individuals can't be identified from the data.

National training surveys

What we hold

On an annual basis, we issue doctors in training and their trainers with a national training survey. We hold the answers that doctors give about their experience of postgraduate training.

Why we hold it

The Medical Act 1983 requires us to monitor and report on the standard of medical training in the UK. The survey helps us make sure doctors in training receive high-quality training in a safe and effective clinical environment, and that trainers are well supported in their role. 

We use the national training surveys to support research into medical training.

Consultations

What we hold

We run consultations on a range of topics related to our regulatory functions. As part of the process, we record the names and contact information of respondents, as well as their answers.

Why we hold it

We hold this information so that we can keep in touch with respondents about the outcome of the consultation.

Social media

We use several social media sites and applications to raise awareness of our work and promote good medical practice. Your use of these sites and applications will be subject to each one’s terms and conditions. Please read their privacy and cookie notices carefully and check your personal settings to make sure you're happy with how your information will be used by the social media site. We don’t actively collect data you submit to any third party websites, but may collect aggregated information (that doesn’t identify you) to help us monitor access to our content.

GMC mobile application and website data

We collect some information about users of our My CPD and My GMP apps. We also use cookies on this website and the MPTS website. You can find more information about what we collect on our websites and on our mobile applications.

Your rights

Accessing your data

You are entitled to request a copy of the personal data we hold about you. To do this, you can email FOI@gmc-uk.org. We'll usually respond within one month, but if the request is complex or involves large amounts of data we have up to three months to respond.

There is usually no charge for making a request, but we have the right to request a fee if the request is unfounded or excessive.

You should be aware that in some cases we do not have to provide a copy of the data because an exemption applies. This is likely to be because:

• the data is also the personal data of another person and it would not be reasonable to disclose it to you without their consent.
• disclosing the data would prejudice our regulatory functions, for example by making it difficult for us to conduct a fair fitness to practise investigation.
• disclosing your data would impair research being conducted by us or on our behalf.

Controlling how we use your data

You have the right under the General Data Protection Regulation to control how we use your data, by asking us to delete it or limit how we use it.

You should be aware that there are exemptions from these rights. We do not have to delete information if we are using it for our statutory functions and have legitimate grounds to continue using the data. There are strong public interest and patient safety grounds for us to process personal data in line with our privacy policy and other policies.

We do not have to delete information or stop using it for research purposes if doing so would impair our research objectives.

Retention periods for personal data

Our records retention schedule explains how long we will keep personal data for.

Our contact details

The data controller for this personal data is the General Medical Council. The Data Protection Officer is Andrew Ledgard. You can contact him by emailing foi@gmc-uk.org

Complaints

If you are unhappy about how we use your personal data, you have the right to complain to the Information Commissioner’s Office.

Mobile app and website data

My CPD

The My CPD app is a tool designed to support doctors on our registers with keeping track of their continuing professional development (CPD). 

Registration data

We will collect limited registration information from you, including your email address so you can continue to use the application. We will not associate any data gathered from this app with any personally identifiable information from any other records we hold.

Analytics data

We will track and store certain types of anonymised data whenever you use our app, such as the stage of your career and year of registration. We will only use this data in aggregate form, for statistical purposes, and not in a way that would enable us to identify you personally. The data will only be used for internal statistical reporting purposes.

CPD data

The CPD data that you enter is for your sole use as the registered user. This data will be stored on our secure server.

Storage

The app is designed to act as a store for your CPD learning and reflections. You should not use the app to store content unrelated to your learning as a doctor. Each user has a storage limit of 2GB. Any files exceeding this limit will automatically be rejected.

Personal data

Under no circumstances should you use the My CPD app to store information that identifies patients or other individuals. You should not include the names of patients or other individuals, or other identifying information about patient or other individuals (eg addresses, reference numbers, or date of birth).

If you disregard this and you do store data that relate to identifiable patients or other individuals, you may be subject to the requirements of the General Data Protection Regulation as a data controller in relation to such data.