These documents show how GP Automate identifies, manages, and contracts around data protection risk for the personal data it processes on behalf of GP practices.

DSPT (Data Security and Protection Toolkit)

Last updated: 14 September 2026

What it is: An annual self-assessment that NHS organisations and their suppliers complete, covering data security and information governance standards across ten areas.

Relevance to GP practices: Practices and ICBs expect any supplier handling NHS data to have met the current DSPT standard. GP Automate has met the standard for 2025-26 (version 8), and practices can verify this directly on the national register.

DPIA for EMIS Web (Labs, Regs and EPS)

Last updated: July 2025

What it is: A Data Protection Impact Assessment (DPIA), required under UK GDPR, that identifies and mitigates privacy risks in a specific data processing activity. This one covers GP Automate's EMIS Web integration.

Relevance to GP practices: It shows practices that GP Automate has formally assessed the data protection risks of the EMIS Web integration their patients' data flows through, supporting practices' own DPIA obligations before adopting the product.

Data protection agreement

Last updated: 14 September 2026

What it is: A contractual agreement setting out how GP Automate processes personal data on a practice's behalf, in line with Article 28 of UK GDPR.

Relevance to GP practices: Practices, as data controllers, need a signed agreement in place with GP Automate as their data processor. This is the document referenced or signed to formalise that relationship and satisfy practices' own compliance obligations.

Privacy policy

Last updated: 14 September 2026

What it is: A public-facing statement explaining what personal data GP Automate collects, why, how it's used and stored, and the rights individuals have over it.

Relevance to GP practices: Practices and their patients can review this to confirm GP Automate's data handling commitments align with UK GDPR, supporting practices' own transparency obligations when explaining third-party data processing to patients.