In May 2021 NHS Digital announced GP Data for Planning and Research (GPDPR), a plan to collect data from every GP record in England to support NHS planning and research. Collection was due to start on 1 July 2021. A key reassurance was that the data would be pseudonymised. I want to explain what that means, and why I think it is a useful safeguard but not a complete one.

What pseudonymisation is

Pseudonymisation replaces the details that identify you with a code. Under GPDPR, your NHS number, full postcode and date of birth were to be replaced with codes before the data left your GP practice, and the data would also be encrypted. Names and exact addresses would not be collected.

Unlike true anonymisation, pseudonymisation can be reversed by whoever holds the key. NHS Digital’s briefing said it could re-identify data only where there was a lawful reason, such as a patient agreeing to take part in a research project, and with approval from advisory groups including IGARD, an independent group that advises on releasing data.

Because the same code is used across datasets, your GP data can be linked to other NHS records about you. That is what makes it so useful for planning and research. Most of that work can be done without ever unlocking who you are.

I think of it as a bit like The Masked Singer. The mask stays on for almost the whole show, but it can come off at the end.

Why it isn’t the whole answer

For years, many people running NHS data projects, including at county level for planning and “risk stratification” (finding patients who need extra care), treated pseudonymisation as the solution to holding large amounts of confidential data. I understood why.

Then researchers showed that people can often be re-identified without the key, by matching the data against other information. A 2019 study in Nature Communications estimated that 99.98% of Americans could be correctly re-identified in any dataset containing just 15 demographic details about them.

We now leave a growing trail of data about ourselves, especially through our phones. When I checked my own Google Maps history in 2021, it showed the days I had visited my GP practice. Combine that kind of trail with a detailed health dataset, and the coded number starts to look much less protective.

The UK data regulator, the ICO, is clear on the legal point. Pseudonymised data is still personal data, and anyone relying on it being anonymous has to assess the real risk of re-identification and keep that assessment under review.

Why that matters

If a detailed health dataset fell into the wrong hands, the harm could be serious. It could help someone find a person who does not want to be found, such as someone escaping domestic abuse. It could be used for convincing scams, for blackmail, or for targeting people with tailored messages.

None of this means NHS data should not be used. Planning and research save lives, and I have spent my career on NHS data. But it does mean pseudonymisation should be one layer of protection, alongside strict controls on who can access the data, where, and for what. The strongest of those is keeping data inside a secure NHS environment where approved researchers can analyse it but cannot take copies away.

You can choose whether your data is used beyond your own care. My guide to NHS data choices explains the options.

Two videos that explain the risks

In 2021 I shared these two short explainers, from Computerphile and minutephysics. They show why removing names from data does not make it anonymous, and how statisticians try to protect privacy. They reflect what was known then; the update below covers what has changed since.

Update, October 2026

  • GPDPR was paused in 2021 and has not restarted. The start was first moved to September 2021. Then, on 19 July 2021, health minister Jo Churchill wrote to GPs to say collection would only begin once conditions were met. These included being able to delete data if a patient opts out, clearing the opt-out backlog, and allowing access only through a trusted research environment. NHS England’s GPDPR page, last updated in February 2026, still says implementation has been deferred.
  • The ICO has updated its guidance. In March 2025 it published final guidance on anonymisation and pseudonymisation, confirming that pseudonymised data remains personal data.