UK GDPR Healthcare Website Guide: What Your Website Specifically Must Do

Saying that your organisation is GDPR compliant does not demonstrate that every website processing activity has been assessed correctly.

A healthcare organisation may have strong internal data protection policies while its website uses an undocumented booking tool, an incorrectly configured analytics platform, or a form with no clearly defined lawful basis.

The website needs its own data flow assessment. Map every point where information enters, leaves, or is stored, then connect each activity to its purpose, lawful basis, recipients, retention approach, and responsible owner.

During healthcare implementations, we have mapped website data capture points before development begins rather than applying one blanket privacy statement after launch.

For a wider view of organisational requirements, review our UK GDPR and data protection compliance guidance.

The ICO's data security incident trends show health as the UK's most reported data breach sector, with 3,820 self-reported personal data breaches between 2023 and Q1 2025.

The figure matters because healthcare websites frequently handle information that can reveal something about a person's health, treatment, or care needs. A seemingly simple website form can therefore carry more sensitivity than a standard commercial enquiry form.

The regulatory ceiling also matters to leadership. According to the ICO's enforcement framework, UK GDPR breaches can attract fines of up to £17.5 million or 4% of global annual turnover, whichever is higher.

For organisations managing both UK and US operations, our guide to how UK GDPR compares with HIPAA can help clarify where the two frameworks differ.

A contact form should not simply sit under the website's general privacy policy. You need to establish why the organisation is collecting the information and identify the lawful basis that applies to that purpose.

For example, an enquiry from someone asking about a service may involve different processing considerations from a marketing subscription. The wording around the form should accurately communicate what information is requested and why.

A practical implementation starts with a form inventory. Record every field, identify whether it is necessary, document the purpose, and connect that purpose to the relevant Article 6 lawful basis.

Appointment booking can involve significantly more information than a general enquiry. Depending on the workflow, a patient may provide contact details, symptoms, medical history, treatment requirements, or other health information.

The processing purpose must be considered before selecting the lawful basis. Health information also creates separate Article 9 considerations, which means Article 6 alone is not enough.

For NHS-facing organisations, these website controls should also be considered alongside NHS digital compliance standards.

Marketing subscriptions require a clear purpose and appropriate consent management where consent is the chosen lawful basis.

A common implementation error occurs when marketing consent is bundled into an unrelated appointment or enquiry process. Patients should not be left unclear about whether they are requesting care information or agreeing to receive marketing communications.

Keep marketing subscriptions separate from operational forms where the purposes differ. That makes the consent record, withdrawal process, and subsequent suppression of marketing communications easier to manage.

A website can support several distinct processing activities at once. Applying one lawful basis across every form can therefore conceal important differences in purpose.

Create a simple processing register for the website that records:

The register becomes a practical governance document rather than another compliance file that nobody consults after launch.

Health data is special category data under UK GDPR. Processing it therefore requires both an Article 6 lawful basis and an applicable Article 9 condition.

That distinction matters when websites collect symptoms, medical histories, treatment details, or other information that reveals health status.

A privacy notice stating that the organisation has a lawful basis does not, by itself, demonstrate that the additional Article 9 requirement has been addressed.

Healthcare processing can involve different Article 9 conditions depending on the purpose and circumstances. The appropriate condition needs to be determined from the actual processing activity rather than selected as a standard website setting.

Clinical intake, direct care, employment related processing, public health activities, and explicit consent can involve different considerations.

For a healthcare website, the important control is traceability. Your records should show why a particular Article 9 condition applies to each relevant processing activity.

Our dedicated guide to Article 9 and special category health data provides further detail for teams reviewing this part of their compliance framework.

Documenting Article 6 without addressing Article 9 leaves the assessment incomplete when health information is processed as special category data.

The gap can occur because developers focus on the form's technical function while legal teams review the organisation's wider processing activities. Neither perspective alone provides the complete website assessment.

Build the Article 6 and Article 9 assessment into the same data mapping exercise. That keeps the legal analysis connected to the actual fields, workflows, integrations, and purposes implemented on the website.

Healthcare websites commonly depend on external services for analytics, appointment booking, forms, live chat, customer relationship management, email delivery, hosting, or other functions.

Where a third party processes personal data on your organisation's behalf as a processor, appropriate contractual arrangements need to be established.

A tool review should therefore happen before implementation. Record the provider, processing purpose, data categories, hosting arrangements, processor status, and relevant contractual documentation.

An embedded tool can introduce a new data flow without changing the visible appearance of your website.

Before approving one, establish:

Across recent compliance projects, we have reviewed booking widgets, chat functions, forms, and other embedded services before they become part of the live healthcare workflow.

The ICO's enforcement activity demonstrates why organisations cannot treat third party processing as someone else's problem.

In March 2025, the ICO issued a £3,076,320 fine against a data processor under UK GDPR following a 2022 ransomware attack that exposed data belonging to 79,404 people and disrupted NHS 111.

The practical lesson for website owners is straightforward. Vendor selection and processor governance form part of your website's data protection risk management.

PECR creates specific rules around cookies and similar technologies used on websites. UK GDPR can then apply to personal data collected through those technologies.

The two frameworks should therefore be assessed together rather than treating cookie consent as a standalone banner design exercise.

Before implementation, identify every cookie and tracking technology, determine its purpose, and establish whether consent or another permitted approach applies.

The ICO expanded its national cookie compliance check to the UK's top 1,000 websites in January 2025. The initiative reflected concerns about whether organisations provide adequate user choice over tracking and personalised marketing.

That makes cookie configuration a live compliance issue rather than a minor website preference.

A practical review should test the actual behaviour of the website, not just the wording of the consent banner. Check what loads before consent, what happens when users reject tracking, and whether withdrawal remains possible.

Healthcare sites often use multiple third party services, which can make cookie governance difficult.

Common problems include:

Our full breakdown of cookie consent requirements can help teams assess this area separately.

A patient may use a website contact route to request access to personal information. The website does not need to fulfil the request itself, but it should route the request into an established data protection process.

That distinction prevents website administrators from becoming accidental decision makers about identity verification, exemptions, disclosure scope, or clinical records.

Build a defined escalation route for access requests. Make sure staff know where requests go, who assesses them, and how the organisation tracks the response.

The right to erasure is not absolute. Healthcare organisations may have legitimate legal, clinical, public health, or other grounds that require certain information to be retained.

A website form should therefore avoid promising that every record can simply be deleted. Instead, it should route the request to the appropriate data protection or governance function.

The website's role is to capture the request accurately and trigger the correct internal process. The substantive decision belongs with the organisation responsible for the relevant records.

Health recorded 910 completed ICO complaint cases in Q3 2025/26, making it the second highest sector in the dataset behind finance, insurance and credit.

The figure reinforces why patient-facing data protection processes need defined ownership rather than depending on informal handling.

Based on our healthcare IT experience, website request routes work better when they connect to an internal workflow with clear ownership, verification, escalation, and auditability.

The strongest implementation model treats this checklist as part of the website release process. New forms, scripts, integrations, and account features should trigger a data protection review before production deployment.

A UK GDPR healthcare website requires more than a privacy policy placed in the footer. Your forms, booking workflows, health data collection, embedded tools, cookies, and data subject request routes all need to reflect the organisation's actual processing activities.

The most effective approach starts with data mapping. Identify what each website function collects, why it collects it, which lawful basis applies, whether Article 9 is relevant, which third parties receive information, and how requests are handled.

The regulatory environment also reinforces the need for practical governance. ICO breach reporting, processor enforcement, cookie compliance checks, and data protection complaints all demonstrate why website controls deserve active ownership.

For healthcare organisations, compliance works best when legal requirements become part of website architecture, development, testing, and ongoing change management.