NHS Federated Data Platform: Patient Consent Requirements and How to Close the Gap

The FDP is a software platform procured by NHS England that allows NHS trusts and integrated care boards to bring together operational data they already hold, such as waiting lists, theatre schedules, discharge information and population health indicators, into common tools. Each organisation runs its own instance, and data is shared between instances only where there is an agreed purpose and legal basis.

The word federated matters. Data is not poured into a single national database; it remains with the organisation responsible for it. That architecture reduces some risks. It does not, on its own, answer the question patients most often ask: who is using my record, for what, and can I say no.

Most FDP use cases do not rely on patient consent as their legal basis. Under UK GDPR, NHS bodies generally process health data under Article 6(1)(e), performance of a task in the public interest, combined with an Article 9 condition such as the provision of health or social care or the management of health systems. Separately, the common law duty of confidentiality must be satisfied, typically through implied consent for direct care or a statutory gateway for other uses.

This distinction is important. Consent in the UK GDPR sense is only one of several lawful bases, and for routine NHS operations it is rarely the one used. The practical consequence is that the FDP can operate lawfully without any patient-level consent record at all.

• Direct care: implied consent under the common law duty of confidentiality, supported by UK GDPR public task and health care conditions.
• Planning and research: statutory routes such as section 251 of the NHS Act 2006, subject to the national data opt-out where it applies.
• Pseudonymisation: identifiers are protected by privacy-enhancing controls before data is used for secondary purposes.

The national data opt-out allows patients to decline the use of their confidential patient information for research and planning. It is a single, binary switch. It cannot express that a patient is content for their data to support cancer research but not commercial product development, or that they wish to review each new purpose as it arises.

Caldicott Guardians carry accountability for these decisions inside each organisation. The eighth Caldicott Principle requires that patients are informed about how their information is used and that there are no surprises. Meeting that principle at the scale of a connected platform, with a verifiable record of each decision, is difficult with paper forms and policy documents alone.

The Data (Use and Access) Act 2025 reforms parts of the UK data protection framework, including provisions on scientific research and recognised legitimate interests. It widens the routes by which data can be used. It does not create a technical mechanism through which individual patients can grant, refine and withdraw permissions for specific purposes.

Closing the gap does not mean replacing the FDP or changing its legal basis. It means adding infrastructure that records patient preferences at a useful level of detail, enforces them wherever data is accessed, and produces evidence that it did so.

• Granular: permissions expressed per purpose, per data category and per recipient type, not as a single opt-out.
• Enforced at the point of use: a query that falls outside a patient’s permissions is excluded automatically rather than filtered later by hand.
• Revocable in real time: withdrawal takes effect for future access immediately, with a clear record of when it applied.
• Auditable: every grant, change, withdrawal and access event is recorded in a tamper-evident log that a Caldicott Guardian or regulator can inspect.
• Federated: the consent check travels to the data; identifiable data does not travel to the consent system.

Consenta is a programmable consent engine. Consent is held as executable, versioned logic rather than static text, evaluated at the moment data is requested, and written to an integrity-protected audit trail. Only hashes of consent events are anchored for tamper evidence; no personal or health data is placed on any ledger.

For NHS organisations, this provides a way to honour patient expectations beyond the minimum legal requirement: to show, with evidence, that a specific use of a specific cohort was within what those patients agreed to. Consenta is in deployment and in discussion with health organisations in the UK and internationally.