Pharmacies handle the most sensitive personal data category that exists under GDPR. Prescription records, medical conditions, controlled drug dispensing records, and medication histories are all special category data under Article 9 — subject to the regulation's strictest protections. Get this wrong and you're not looking at a theoretical fine; you're looking at real patient harm and regulatory action from both the ICO and the General Pharmaceutical Council.
This guide is written for independent pharmacy owners and pharmacy managers. It covers lawful basis, PMR system data processor obligations, NHS data sharing, dispensing robot data, online pharmacy compliance, retention rules, patient confidentiality at the counter, marketing restrictions under PECR, and a practical compliance checklist you can act on today.
Start by scanning your pharmacy website at Custodia to see what data your digital presence is collecting — it takes 60 seconds.
Why Pharmacy Data Is the Most Sensitive Personal Data Category
Under GDPR Article 9, certain categories of personal data receive heightened protection because their misuse could cause particularly serious harm. Health data is at the top of this list. Pharmacy records almost always fall into multiple special categories simultaneously:
- Prescription records — reveal specific medical conditions and diagnoses
- Medication histories — disclose ongoing chronic conditions, mental health treatment, or HIV status
- Controlled drug dispensing records — legally required but highly sensitive; reveal addiction treatment, pain management, and Schedule 2/3 controlled drug use
- Medical conditions — required to perform clinical checks (interactions, contraindications)
- Methadone and supervised consumption records — particularly sensitive data about drug dependency treatment
A patient's prescription record can reveal their HIV status, mental health diagnosis, cancer treatment, or addiction history. This is not abstract compliance concern — it is data that, if disclosed, could damage relationships, employment, and safety.
Under Article 9(1), processing this data is prohibited by default. Processing is only lawful under one of the Article 9(2) conditions.
Lawful Basis for Processing Health Data
Article 9(2)(h) — Healthcare Provision
The primary lawful basis for pharmacies is Article 9(2)(h): processing necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services.
This covers the core dispensing function: receiving prescriptions, dispensing medications, performing clinical checks, and maintaining patient medication records. You do not need patient consent to process health data for dispensing purposes — the legal basis exists under Article 9(2)(h) combined with Article 6(1)(c) (legal obligation) for Schedule 2 controlled drug register requirements.
This is important: relying on patient consent for core dispensing activities is incorrect. Consent must be freely withdrawable, and a patient cannot meaningfully withdraw consent from medication dispensing without ceasing treatment. Use the correct legal basis.
Article 9(2)(i) — Public Health
Processing for public health purposes — such as flu vaccination services, NHS screening programmes, or public health monitoring — can be justified under Article 9(2)(i).
Article 9(2)(a) — Explicit Consent
Explicit consent is appropriate for non-essential health data processing: voluntary services like weight management programmes, health checks not required for dispensing, or wellness services. This requires a clear, specific consent request — not buried in terms — with the ability to withdraw at any time.
Article 6 Basis for Non-Health Data
Contact details, payment records, and delivery addresses are not special category data, but still require an Article 6 basis:
- Contract — collecting details needed to fulfill the dispensing service
- Legal obligation — maintaining records required by law (Controlled Drugs regulations, GPhC requirements)
- Legitimate interests — appointment reminders, service communications
PMR Systems as Data Processors
Your Patient Medication Record (PMR) system — whether Cegedim, Rx Systems (formerly RxWeb), Pharmacy Manager (Cegedim/EMIS), or another platform — processes special category health data on your behalf. Under GDPR Article 28, you must have a Data Processing Agreement (DPA) in place with every PMR provider.
Most PMR vendors have standard DPAs available. You must review and sign them — not just assume they are in place. Key DPA requirements include:
- The processor may only process data on your documented instructions
- They must implement appropriate technical and organisational security measures
- They must assist you in responding to data subject rights requests
- They must delete or return data on termination of the contract
- They must not subcontract without your prior written authorisation (or general authorisation with notice rights)
Your PMR system likely has sub-processors — cloud hosting providers, backup services, support platforms. The DPA should require the processor to maintain a list of sub-processors and notify you of changes.
Action: Request and sign DPAs with all PMR vendors. Review sub-processor lists. Ensure processors are UK-based or have adequate transfer mechanisms if located outside the UK.
NHS Spine and Electronic Prescription Service Data
Pharmacies connected to the NHS Spine and Electronic Prescription Service (EPS) process data as part of an NHS-controlled infrastructure. The NHS Digital Data Security and Protection Toolkit (DSPT) applies — annual completion is required for NHS contract holders.
Under EPS, prescription data flows from GP systems to the NHS Spine to your PMR. The data controller relationships are shared: NHS England controls the Spine infrastructure; you are an independent controller for your local dispensing records.
Key obligations:
- DSPT compliance — complete annually and maintain evidence of compliance
- Network security — EPS access requires N3/HSCN (Health and Social Care Network) connectivity with appropriate controls
- Access controls — only authorised staff with individual smartcard credentials should access NHS Spine systems
- Audit trails — Spine access is logged; you should maintain local audit logs of PMR access by staff member and timestamp
Sharing Medication Data with GPs and Hospitals
Pharmacies routinely share patient data with GPs and secondary care. This is lawful under Article 9(2)(h) but still requires appropriate safeguards.
What is permitted:
- Sharing dispensing records with GPs for clinical care coordination
- Sending Medicines Use Review (MUR) and New Medicine Service (NMS) records to GP practices
- Sharing information with hospital discharge teams managing medication on transfer of care
- Providing summary medication records to emergency services when clinically necessary
What requires additional consideration:
- Sharing with third-party health apps or digital platforms (requires explicit consent)
- Sharing medication data with employers or insurance companies (almost never lawful without explicit consent)
- Marketing patient data to pharmaceutical companies (not lawful)
Verbal requests for patient information — for example, a call claiming to be from a GP surgery — should be verified before disclosure. Establish a protocol: call back on the practice's published number, not the number provided in the request.
Dispensing Robot Data
Automated dispensing systems (robots) create additional data considerations. Robots log:
- Prescription data passed to the system
- Dispensing timestamps and batch records
- Error logs and intervention records
- Stock movement linked to specific prescriptions (in some systems)
This robot-generated data is still personal data if it can be linked to an identified patient. Your DPA with the robot manufacturer or software provider must cover this processing. Audit logs from dispensing robots may also be required for controlled drug accountability.
Ensure robot system access is role-restricted and that remote access by the vendor for maintenance is documented, time-limited, and auditable.
Online Pharmacy Compliance: GDPR and CQC
Online pharmacies face a dual regulatory framework: GDPR from the ICO and registration with the Care Quality Commission (CQC) in England (NHS BSA for Scotland and Wales). Both frameworks impose data obligations.
GDPR-specific requirements for online pharmacies:
- Online consultation forms collect health data directly. Your lawful basis must be documented and visible at point of collection. Cookie consent banners must not capture health data before consent is given.
- Patient registration databases contain full medication histories. These require particularly strong access controls, encryption at rest and in transit, and regular penetration testing.
- Identification verification — online pharmacies must verify patient identity. The data collected for ID verification (copies of ID documents) is sensitive and should be deleted once verification is complete unless there is a legal reason to retain it.
- Delivery data — medication delivery to home addresses links personal identity to medication type, even if encrypted. Delivery partners who handle this data are sub-processors requiring DPAs.
CQC registration data requirements include maintaining records of consultations, clinical decisions, and prescribing rationale. These must be retained for the periods required by CQC standards, which align broadly with NHS retention schedules.
Your online pharmacy website needs a compliant cookie consent mechanism, a detailed privacy notice explaining health data processing, and a clear complaints procedure including the right to complain to the ICO.
Patient Medication Record Retention
GDPR's storage limitation principle requires you to retain data only as long as necessary. For pharmacies, retention is largely governed by external legal and professional requirements:
| Record Type | Minimum Retention Period |
|---|---|
| Prescription records (dispensed) | 2 years (GPhC requirement) |
| Controlled drug register | 2 years from last entry |
| Patient Medication Records (PMR) | 8 years (NHS retention schedule — align to this) |
| Methadone/supervised consumption records | Minimum 7 years |
| Dispensing robot audit logs | 2 years minimum |
| NMS/MUR records | 2 years |
| Staff training records | Duration of employment + 6 years |
After the retention period expires, records must be securely deleted or destroyed. For paper records, this means cross-cut shredding or a certified confidential waste service. For electronic records, secure deletion meeting the standard in your jurisdiction (typically overwriting or cryptographic erasure).
Document your retention policy and review it annually. The GPhC and ICO both expect you to demonstrate that you have a retention schedule and that you follow it.
Pharmacy Counter Confidentiality
The physical dispensing counter presents underappreciated GDPR risks. Conversations about medication at the counter — within earshot of other customers — are a confidentiality risk. Prescriptions visible on counters, computer screens facing customers, and verbal confirmation of prescription contents are all potential breaches.
Practical measures:
- Position dispensing computers so screens are not visible to customers waiting in the queue
- Use screen privacy filters on dispensing workstations
- Design consultation areas so private conversations cannot be overheard
- Train counter staff that confirming medication details verbally in a shared space is a risk
- Do not leave prescription bags with patient names and medication visible in accessible areas
- Prescription collection: verify identity before disclosing which medications are ready
These are basic but frequently overlooked. An ICO complaint can be triggered by a single incident where a patient's HIV medication is discussed within earshot of other customers.
Marketing Health Products: PECR Rules
The Privacy and Electronic Communications Regulations (PECR) sit alongside GDPR and govern electronic marketing. For pharmacies, the rules are strict.
Email and SMS marketing to patients:
You cannot send unsolicited marketing by email or SMS to individual patients without prior explicit consent, even if they are existing customers. The soft opt-in exception (which allows email marketing to existing customers about similar products) applies only to products and services similar to what the customer purchased. It does not allow you to use a prescription dispensing relationship as a basis for marketing vitamins, health supplements, or pharmacy retail products.
What this means in practice:
- Appointment reminders and prescription ready notifications are not marketing — they are service communications. These are lawful under legitimate interests or contract basis.
- A newsletter promoting health products requires explicit prior consent, separate from the dispensing relationship.
- SMS messages about flu vaccination clinics to existing patients are marketing — they require prior consent unless you have a specific exemption for NHS-commissioned public health services.
Consent records: For any email or SMS marketing, maintain a record of when and how consent was obtained, the exact consent wording shown, and the mechanism for withdrawal. If you cannot produce this record, you cannot demonstrate lawful marketing.
Compliance Checklist for Pharmacies
Use this checklist to assess your current position:
Lawful Basis and Documentation
- [ ] Documented lawful basis (Article 6 and Article 9) for each processing activity
- [ ] Records of Processing Activities (RoPA) maintained and up to date
- [ ] Privacy notice published and accessible to patients
- [ ] Staff aware of the difference between dispensing lawful basis and consent for non-essential processing
PMR and Third-Party Systems
- [ ] Data Processing Agreement signed with PMR provider
- [ ] Sub-processor list reviewed and approved
- [ ] DPAs in place with all third-party platforms (online consultation tools, delivery partners, robotics vendors)
- [ ] DSPT completed and submitted (if NHS contractor)
Access Controls and Security
- [ ] Individual user accounts for all PMR system users (no shared logins)
- [ ] Access controls reviewed and restricted to role requirements
- [ ] Screen privacy filters on customer-facing workstations
- [ ] Remote access by vendors documented, time-limited, and auditable
- [ ] Encryption confirmed for data at rest and in transit
Retention and Deletion
- [ ] Written retention schedule covering all record types
- [ ] Secure deletion process in place for expired records
- [ ] Confidential waste contract in place for paper records
Marketing and PECR
- [ ] Explicit consent records maintained for email/SMS marketing
- [ ] Prescription notification communications reviewed — confirmed as service, not marketing
- [ ] Opt-out mechanism working and actioned promptly
Patient Rights
- [ ] Process in place for handling subject access requests within 1 month
- [ ] Staff trained to recognise and escalate data subject rights requests
- [ ] Identity verification process before disclosing records
Incidents
- [ ] Data breach reporting procedure in place (72-hour ICO notification requirement)
- [ ] Incident log maintained
- [ ] Staff trained to recognise and report breaches
Next Steps
Pharmacy GDPR compliance has more moving parts than most sectors because of the interplay between ICO obligations, GPhC professional standards, NHS data security requirements, and PECR marketing rules. The good news is that most independent pharmacies already have the clinical governance mindset that makes GDPR achievable — the challenge is formalising it in documented policies and ensuring digital systems are covered.
Run a free scan of your pharmacy website at https://app.custodia-privacy.com/scan to see exactly what data your digital presence is collecting, whether your consent management is working, and where your compliance gaps are. Results in 60 seconds, no signup required.
This post provides general information about GDPR compliance for pharmacies. It does not constitute legal advice. Requirements vary by jurisdiction and individual circumstances differ. Consult a qualified data protection professional or pharmacy legal advisor for advice specific to your business.
Top comments (0)