The 2026/27 GP Contract came into force on 1 April 2026, and introduced a wide ranging operational requirement for practices, particularly in relation to access, demand management and the removal of digital contact caps. However, one contractual change with potentially significant legal consequences has attracted comparatively little attention: a new obligation requiring GP practices to disclose detailed staff information to their Integrated Care Board (ICB).
While NHS England characterises the requirement as a means to support workforce planning, the change represents a material shift in the nature and volume of personal data that Boards will hold about practice employees. This has clear implications for UK GDPR compliance, employment law, and the broader governance landscape within which practices operate.
A new contractual obligation with far reaching consequences
Practices now must provide their ICB with:
- Full names of all staff
- Job roles
- Contact telephone numbers or email addresses
- Notifications whenever staff join, leave, or change role.
This requirement applies to all workers engaged by the practice. Not only clinical staff but also administrative, managerial and support roles.
Its introduction marks an expansion of Board’s oversight into areas traditionally reserved to the employer. As such, practices will need to consider carefully whether their internal legal, HR and governance arrangements remain fit for purpose.
Key UK GDPR and confidentiality concerns
- Lawful basis and necessity
Although the new GP Contract establishes an obligation to share staff data, practices must still be satisfied that any disclosure to the ICB meets the requirements of the UK GDPR, including:
Lawfulness: identifying a valid lawful basis under Article 6.
Necessity: demonstrating that sharing the information is genuinely required for the stated purpose.
Proportionality: ensuring the scope of data provided is not excessive.
Given that ICBs are not the employer and usually hold no direct staff management responsibilities, practices will need to assess whether the breadth of information requested aligns with the principle of data minimisation and whether a contractual requirement alone provides sufficient justification.
- Transparency obligations
Practices will also need to update:
- Staff privacy notices
- Data protection impact assessments (where appropriate)
- Internal data handling procedures.
Employees may reasonably question why their contact details are being shared with a Board. Practices must therefore be prepared to explain the legal basis, purpose and implications of this new data flow.
- “Function creep” and the risk of expanded commissioner influence
Once Boards hold detailed staff-level data, there is a risk that its use may expand over time, for example, informing performance management discussions, influencing contractual variations, or supporting future workforce policies.
Practices should consider how to safeguard against unintended re-purposing of the data, and whether additional contractual assurances or data sharing agreements are required.
- Increased administrative and compliance burden
The obligation to provide “real-time” updates introduces a new operational requirement that may necessitate revised internal workflows and potentially additional administrative resource. Inaccurate or late reporting could also create contractual performance risks.
The broader contractual context: Board oversight is increasing
The staff data requirement is consistent with a wider trend in the 2026/27 Contract towards enhanced Board visibility and involvement. Other changes include:
- Mandatory same day responses for clinically urgent requests
- A prohibition on instructing patients to “call back tomorrow”
- Removal of caps of online consultation submissions
- Enhanced ICB monitoring of access, demand and patient flow metrics.
Taken together, these measures suggest a shift towards closer day to day oversight of general practice, making governance, record keeping and contractual compliance more critical than ever.
What GP practices should do now
- Document your lawful basis for sharing staff data
Relying on the contractual obligation alone may not be sufficient without a clear articulation of why the processing is necessary. Practices should update their records of processing activities and consider whether a Data Protection Impact Assessment is appropriate.
- Update privacy notices, staff handbooks and internal policies
These documents should clearly set out:
- What information will be shared
- The purpose of the sharing
- The legal basis for doing so
- Who the data will be shared with
- Retention and deletion arrangements.
- Prepare to manage staff queries
Given the sensitivity of personal contact details, transparent engagement with staff will be essential to mitigate concerns and avoid internal disputes.
- Establish a robust internal workflow for “real-time” updates
This may involve updating onboarding/leaver processes, assigning administrative responsibility, and ensuring accurate data quality.
- Monitor emerging guidance
NHS England is likely to publish further clarification on the requirement. Early legal advice can help practices avoid inadvertent non-compliance and ensure any data sharing agreement with the ICB is appropriately drafted.
Conclusion
The 2026/27 GP Contract introduces one of the most significant extensions of Board oversight in recent years. While operational changes have dominated sector commentary, the new obligation to share detailed staff information raises important UK GDPR, confidentiality and governance issues that practices must take seriously.
Ensuring compliance is not simply a data protection exercise, it requires coordinated action across HR, operations and legal governance.
If your practice would benefit from tailored advice or support in reviewing your data protection documentation and contractual obligations, please do get in touch and we would be pleased to assist.
Speak to an expert
For more information, contact Chidem Aliss in our corporate and commercial team on 0345 209 1000 or or send an enquiry.
