GMC reference number and register status on every record, with a documented lawful basis and the one distinction most UK outreach gets wrong built into the data.
Yes, with conditions narrower than most suppliers admit. The GMC register is public and you may use it to establish who a doctor is and what they are registered to do. Building a contact database on top of it is processing personal data under UK GDPR, so it needs a documented lawful basis. The part that catches people is PECR, which asks a different question and gives a different answer depending on who the doctor is.
Yes, with conditions that are narrower and more specific than most suppliers admit. The GMC register is public and you may use it to establish who a doctor is, what they are registered to do and whether they hold a licence to practise. Building a contact database on top of that is processing personal data under UK GDPR, so it needs a lawful basis, and for commercial outreach that basis is normally legitimate interests, which requires a documented assessment rather than an assertion. The part that catches people is PECR, which governs the electronic message itself and asks a different question. PECR does not require consent to email a corporate subscriber, so a consultant at an NHS trust address is reachable without opt in. It does require consent for an individual subscriber, and a GP practice structured as a partnership or a sole trader counts as one. The same email can be lawful to one doctor and unlawful to another on the same list.
As an identity spine the register is excellent. It records registration status, the GMC reference number, licence to practise and Specialist or GP Register entry. As a commercial dataset it is deliberately nothing at all. That inverts the US problem: there the identifier arrives with a public contact file attached and the work is verifying it, here the identifier is clean and the contact layer has to be built lawfully from scratch.
The GMC maintains the medical register and a separate register for physician associates and anaesthesia associates. For doctors it records registration status, the GMC reference number, whether the doctor holds a licence to practise, and whether they appear on the Specialist Register or the GP Register. It is searchable by name or by reference number, including several reference numbers at once.
As an identity spine it is excellent. As a commercial dataset it is deliberately nothing at all, and that is the whole shape of the UK problem.
So the UK build is the inverse of the US one. In the United States the identifier comes with a public contact file attached and the work is verifying it. In the UK the identifier is clean and authoritative and there is no contact layer at all, so the work is constructing one lawfully and being able to show how.
| What the register answers | What it does not answer |
|---|---|
| Is this person registered, and under what reference number | Where do they currently work |
| Do they hold a licence to practise, and are they revalidating | What is their email address or direct line |
| Are they on the Specialist Register or the GP Register, and in which specialty | What is their sub specialty interest in practice, which is frequently narrower than their registered specialty |
| Are there restrictions or conditions on their registration | Do they want to hear from you, and through which channel |
Usually not, and the reason matters more than the answer. PECR separates corporate subscribers from individual subscribers. Consent is not required to email a corporate subscriber, so a consultant at an NHS trust address is reachable. It is required for an individual subscriber, and a GP practice structured as a partnership counts as one. The same email can be lawful to one doctor on your list and unlawful to the next.
Usually not, and the reason matters more than the answer, because it changes depending on who the doctor is.
PECR, the rules that govern electronic marketing, draws a line between corporate subscribers and individual subscribers. Consent is not required to send marketing email to a corporate subscriber. It is required for an individual subscriber. An NHS trust is a corporate subscriber, so a consultant reached at their trust address generally sits on the permitted side of that line. A GP practice operating as a partnership, and any doctor operating as a sole trader, is treated as an individual subscriber, so the same message needs consent or the soft opt in.
This is why entity type sits on our UK records as a field rather than being left for the campaign team to work out. A list that mixes trust consultants and GP partners without distinguishing them is not a segmentation problem, it is a compliance problem, and it is the single most common failure in UK HCP outreach.
| Who you are contacting | PECR position | What that means for the list |
|---|---|---|
| Consultant at an NHS trust, using a trust address | Corporate subscriber. Consent not required for email | Reachable under legitimate interests, with an opt out in every message |
| Doctor at a limited company or an LLP | Corporate subscriber | Same position as above |
| GP at a practice structured as a partnership | Treated as an individual subscriber. Consent required | Needs consent or the soft opt in, which applies only where they have previously bought from you and did not opt out |
| Doctor operating as a sole trader | Treated as an individual subscriber. Consent required | Same as above |
| Any doctor who has objected to marketing | The objection is absolute under UK GDPR | Suppressed permanently, across every channel and every campaign |
The usual basis for commercial use is legitimate interests, and relying on it means passing a three part test and recording that you did. A legitimate interests assessment is a short document, not a sentence in a privacy policy. Any supplier who answers this question with the words we are GDPR compliant has told you they do not have one. Ask to see it. We will send ours.
Holding and using doctor data for commercial purposes is processing personal data under UK GDPR. The usual lawful basis is legitimate interests, and relying on it requires passing a three part test and recording that you did.
A legitimate interests assessment is a short document, not a sentence in a privacy policy, and any supplier who answers the lawful basis question with the words "we are GDPR compliant" has told you they do not have one. Ask to see it. We will send ours.
| The test | What has to be true | What we hold |
|---|---|---|
| Purpose | There is a specific, identified interest in the processing | The purpose is recorded per use case rather than as one blanket statement |
| Necessity | The processing is necessary to achieve that purpose, meaning there is no less intrusive way to do it | Field level justification, so we can show why a given attribute is held rather than defending the whole record at once |
| Balance | The interest does not override the rights and reasonable expectations of the individual | A documented balancing exercise, reviewed rather than written once |
Nine field groups, two of which exist on no other country page we publish. Entity type is specific to how PECR works and register entry is specific to how the GMC is structured. That is what we mean when we say the record is built on the market rather than translated into it.
The same record model runs in every market we cover. These are the fields that carry UK specific content.
Two of those rows do not exist on our records in other markets. Entity type is specific to how PECR works, and register entry is specific to how the GMC is structured. That is what we mean when we say the record is built on the market rather than translated into it.
| Field group | What it holds |
|---|---|
| Identity | GMC reference number, full name with known variants, registration status, licence to practise status |
| Register entry | Specialist Register or GP Register entry, registered specialty, any recorded conditions or restrictions |
| Grade and role | Consultant, specialty registrar, GP partner, salaried GP, clinical lead and similar, where evidenced |
| Affiliation | NHS trust or health board, ICB area, private provider, practice, with the relationship typed |
| Entity type | Corporate subscriber or individual subscriber, which determines the PECR position for that doctor |
| Location | Site, town, region, nation within the UK |
| Evidence of standing | Publications with citation counts, trial participation, congress activity, guideline and royal college roles |
| Contact | Verified work email and direct line, with unverified candidates held separately and flagged rather than mixed in |
| Governance | Lawful basis, objection and suppression flags, source and timestamp on every enriched value, completeness score |
A buyer finds these out in the first sample anyway, so it is better to hear them here.
UK doctors are harder to reach by direct email than US physicians, because there is no public contact file equivalent to NPPES. Any UK supplier quoting coverage in the high nineties is either counting unverified addresses or counting generic practice mailboxes as individual contacts.
Not a coverage gap, a deliberate exclusion. A personal mobile for a doctor is an individual subscriber contact point in almost every case and the TPS and PECR position on it is not one we want our clients standing behind.
Where we cannot establish whether a practice is a partnership or an incorporated entity, the field says unknown rather than guessing. An unknown you can see is worth more than a guess you cannot.
Four different jobs, one record layer underneath.
Target list build and segmentation by specialty and trust, with the ABPI Code position on the communication handled separately from the audience build.
Identifying scientific leaders through publications, trials, congress activity and royal college roles rather than commercial proxies.
Reaching the clinical decision maker and mapping the route through trust procurement, which is a different motion from individual targeting.
Mapping ICB level stakeholders and understanding who sits where, which is the part that changes most often and dates fastest.
Most UK engagements start with a compliance conversation rather than a data sample, because that is the question the buyer is being asked internally.
We fill empty fields only. Nothing you already hold is overwritten, and every value we add carries its source and the date.
1. We send our legitimate interests assessment and our source documentation before you send us anything.
2. You send a sample of your existing records, typically five thousand rows.
3. We match to GMC reference number, report the match rate, and flag entity type so you can see the PECR split across your own list.
4. We fill empty fields only. Nothing you already hold is overwritten, and every value we add carries its source and the date.
5. You get a before and after report with the file, including how many of your existing records were reachable on the basis you thought they were.
We hold doctor data in these markets too, each one built on that market’s own practitioner register rather than mapped across from somewhere else. Hover a country to see what sits behind the records there.
Doctor data coverage
Built on NPI registry · state medical boards
Every record anchored to an NPI, so one physician stays one record across your CRM, your claims data and ours.
Doctor data coverage
Built on NMC · state medical councils
Our deepest coverage, across specialties and clinic affiliations, with consent captured and evidenced under DPDP.
The questions a UK buyer actually puts to a supplier, and to an AI assistant, answered without the hedging.
Send a sample of five thousand doctor records and get a GMC match rate, a fill rate and a corporate versus individual subscriber breakdown back, with the enriched file.
Request a sample