5 GDPR mistakes practices make with patient feedback

Five GDPR mistakes crop up again and again when practices handle patient feedback: public review replies that confirm someone is a patient, feedback requests the privacy notice never mentioned, feedback landing in wide-open shared inboxes, comments kept forever with no retention rule, and feedback tools engaged without a data processing agreement. This article is practical guidance, not legal advice – your data protection officer and the ICO’s published guidance remain the authorities – but these five are worth checking this month.

Mistake 1: public replies that confirm someone is a patient

A Google review is public; your reply confirming the reviewer attended, when, or why is a disclosure of health-related personal data – arguably special category data – to the entire internet. “We’re sorry your check-up ran late on Tuesday” tells every reader this named person is your patient, even though they only chose to tell Google.

The fix: a house rule that no public reply ever confirms patient status or any detail of care. “Thank you for your feedback. We can’t discuss individual circumstances publicly, but please contact our practice manager on [email/number] so we can help.” One template, every case, zero disclosure – and replying still pays: businesses that respond to reviews are seen as 1.7× more trustworthy (Google/Ipsos).

Mistake 2: feedback requests your privacy notice never mentioned

Texting patients a feedback link uses contact details collected for care. That can be lawful and reasonable – but transparency rules mean patients should be told, in your privacy notice, that contact details may be used to invite feedback, which lawful basis you rely on, and how to opt out. Many practices simply started sending and never wrote it down.

The fix: add a short paragraph to your privacy notice covering feedback invitations, record the lawful basis your DPO agrees on, and honour opt-outs immediately – a patient who says “stop texting me” must actually drop off the list.

Mistake 3: feedback sitting in a wide-open shared inbox

Private feedback often contains names, phone numbers and descriptions of care alongside the complaint. When it lands in reception@ with the password on a sticky note, every locum, temp and work-experience student can read it – far beyond the “appropriate security” the UK GDPR requires, and far beyond who actually needs to know.

The fix: route feedback to named individuals – the practice manager and a deputy – with individual logins. Access on a need-to-know basis is the principle; a two-name distribution list is usually the practice.

Mistake 4: keeping feedback forever

Storage limitation is the forgotten principle: personal data kept no longer than needed. Feedback from 2019, complete with patients’ names and complaints, still sitting in a spreadsheet “in case it’s useful”, has no defined purpose left – it is simply risk on a shelf.

The fix: set a retention period for feedback (your DPO can advise what suits your complaints procedures), diarise an annual purge, and keep long-term trends as anonymised summaries – “12 complaints about phone waits in 2025” needs no names attached.

Mistake 5: feedback tools with no data processing agreement

Any tool that sends review invitations or collects private feedback on your behalf is a data processor, and the UK GDPR requires a written data processing agreement before it touches patient data. Practices routinely sign up to software with a card and a click, and never ask where the data lives or who can see it.

The fix: before adopting any feedback tool, ask three questions in writing: is there a DPA we can sign, where is the data stored, and how is it deleted when we leave? A supplier who cannot answer crisply has answered anyway.

Compliance and reviews are not in tension

None of this stops you asking for feedback – 71% of patients check online reviews as the first step in finding a new doctor (Software Advice), so asking properly matters more than ever. The practices that get this right ask everyone, keep public replies content-free, and treat private feedback with the same discipline as the medical record. Careful and effective turn out to be the same system.