What are the legal requirements for setting up a private GP practice in the UK?
A checklist of the legal duties that apply to a new private GP practice, the law behind each one, and the things that are good practice but not required.
The short answer
You need a GMC licence to practise with a revalidation connection, indemnity cover for your private work, and registration with the service regulator (the CQC in England) unless a narrow exemption applies. You must also pay the ICO data protection fee and comply with UK GDPR, register the business with HMRC, and meet health and safety, fire, clinical waste, medicines and consumer law. Employing staff adds employment law and compulsory employer’s liability insurance.
Key points
- Professional: a GMC licence to practise, a revalidation connection and indemnity appropriate to your private work, required by the Medical Act 1983.
- Regulatory: CQC registration in England, or the equivalent regulator in Scotland, Wales or Northern Ireland, before you see patients.
- Data: pay the ICO fee and meet UK GDPR, including a privacy notice, security and breach handling.
- Business: register with HMRC, and with Companies House if you trade as a company. Most GP consultations are VAT exempt, but not all services are.
- Premises and practice: health and safety, fire risk assessment, clinical waste, medicines law and consumer law all apply from day one.
This article lists what the law requires. The order to tackle it in, with a timeline, is in how to start a private GP practice. England is the default. Where the other nations differ, that is noted.
1. Professional requirements
| Requirement | Legal basis | What to do |
|---|---|---|
| GMC registration with a licence to practise | Medical Act 1983 | Keep your licence, and declare private work in your annual appraisal so it covers your whole scope of practice. |
| A revalidation connection | Medical Profession (Responsible Officers) Regulations 2010 | If you leave NHS work, you need a new designated body, such as a private hospital or an appraisal organisation. See appraisal and revalidation. |
| Indemnity appropriate to your work | Medical Act 1983, section 44C | The NHS state-backed schemes do not cover private work. Get written confirmation of cover. See indemnity for private GPs. |
The GMC’s standards, including Good medical practice and its guidance on consent, prescribing and advertising, apply to private work exactly as they do to NHS work.
2. Registering the service
In England, the legal entity carrying on a regulated activity, such as treatment of disease, disorder or injury, must be registered with the CQC under the Health and Social Care Act 2008. Doing so without registration is an offence. There is a narrow exemption for some doctors seeing patients face to face in a consulting room. See do I need to be registered with the CQC?
In Scotland register with Healthcare Improvement Scotland, in Wales with Healthcare Inspectorate Wales, and in Northern Ireland with RQIA. Each has its own scope and exemptions.
Registration brings continuing legal duties: the fundamental standards, including consent, safeguarding, complaints, good governance and the duty of candour, plus notifications and an accurate statement of purpose.
3. Data protection
- ICO data protection fee. Required for controllers under the Data Protection (Charges and Information) Regulations 2018. See do I have to register with the ICO?
- UK GDPR and the Data Protection Act 2018. A lawful basis and a special category condition for health data, a privacy notice, security, breach reporting and subject access. Since June 2026 you also need a data protection complaints process.
- Records retention. Keep records for as long as you need them for care and legal purposes, and set this out in a retention policy.
4. Business and tax
- HMRC. Register for Self Assessment as a sole trader or partner, or register a company with Companies House, which then has its own corporation tax obligations. See should I set up a company?
- VAT. Medical care by a registered doctor is generally exempt, but some services, such as certain reports and medicals, are standard-rated. You must register if your taxable turnover goes over the threshold, which was £90,000 at the time of review. See do private GPs need to charge VAT?
- Insurance. Employer’s liability insurance is compulsory once you employ anyone. The CQC also asks new providers for a public and employer’s liability insurance quote or certificate. See insurance for a private practice.
5. Premises
- Health and safety. The Health and Safety at Work etc. Act 1974 applies to every workplace. Once you employ five or more people you must have a written health and safety policy. Risk assessments, COSHH and first aid arrangements apply more widely.
- Fire safety. The Regulatory Reform (Fire Safety) Order 2005 requires a fire risk assessment by the responsible person for non-domestic premises in England and Wales. Scotland and Northern Ireland have their own fire safety law.
- Accessibility. The Equality Act 2010 requires reasonable adjustments for disabled patients. See accessibility requirements.
- Planning and building control. Check the premises can lawfully be used for medical services, and keep building control sign-off for any works. The CQC asks for the final certificate where approval was needed. See choosing premises.
6. Clinical practice
- Prescribing. Private prescriptions must meet the Human Medicines Regulations 2012. Schedule 2 and 3 controlled drugs need the private CD prescription form and a private prescriber code under the Misuse of Drugs Regulations 2001. If the service will hold stocks of controlled drugs, rather than only prescribing them, check whether you need a Home Office controlled drugs licence. Even a single box held for future use, such as emergency midazolam, counts as stock. The CQC lists private primary care clinics among services that may need a licence, and says getting one can take at least six months, so ask the Home Office Drugs and Firearms Licensing Unit early. See private prescribing and EPS.
- Clinical waste. The duty of care under the Environmental Protection Act 1990 and hazardous waste rules. See dealing with medical waste.
- Safeguarding. CQC regulation 13, and appropriate DBS checks for you and your staff. See getting a DBS check.
- Consent. Required in law and by the GMC. See informed consent in private practice.
7. Consumer law
Private patients are also consumers. The Consumer Rights Act 2015 requires services to be provided with reasonable care and skill, and information you give about the service is binding. If patients book online or by phone, the Consumer Contracts Regulations 2013 generally apply. You must give certain information before booking, and explain cancellation rights. Advertising and pricing must not mislead, under the CAP Code and the Digital Markets, Competition and Consumers Act 2024. See the rules on advertising.
8. If you employ staff
- right to work checks before employment starts
- written statement of employment particulars, the National Minimum Wage and working time rules
- PAYE and workplace pension auto-enrolment
- employer’s liability insurance
- recruitment checks required by CQC regulation 19, including DBS where eligible.
See employment law when hiring staff.
Good practice, not law
Some things are often presented as requirements but are not. Membership of the Independent Doctors Federation, subscribing to the Independent Sector Complaints Adjudication Service (ISCAS) and using an NHS-built record system are all optional. The Data Security and Protection Toolkit is needed only if you want access to certain NHS systems, such as NHSmail. They may still be worth doing, but decide on their merits.
Frequently asked questions
Do I need permission from my NHS employer or practice to work privately?
Not by law, but your contract may restrict private work or require you to declare it, and NHS contract rules limit seeing your own NHS patients privately. See the restrictions on seeing private patients in NHS practices.
Is there a legal minimum set of policies?
The law does not list policies as such, but CQC registration requires a statement of purpose and a core set, including complaints, consent, safeguarding, infection control, medicines and recruitment policies.
Do the same rules apply in Scotland, Wales and Northern Ireland?
Professional, data protection and tax rules are UK-wide. Service registration, fire safety and some health and safety and waste rules differ, so check with the regulator in your nation.
Sources
- Medical Act 1983, section 44C
- Register as a provider
- Guide to the data protection fee
- When to register for VAT
- Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, regulation 7
- Supporting documents: documents everyone must send
- Employers’ Liability (Compulsory Insurance) Act 1969: a guide for employers
- Home Office controlled drugs licences
