This Practice Note sets outs the issues an employer will need to consider when seeking medical reports on employees and prospective employees.

Before obtaining a medical report, an employer will need to consider the legislative Requirements:

1. •

   for Processing Personal data and special category data (special categories of personal data, formerly ‘sensitive personal data’) under Assimilated Regulation (EU) 2016/679, UK General Data protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018)

2. •

   for consent from the employee or prospective employee under the Access to Medical Reports Act 1988 (AMRA 1988), and

3. •

   if the medical report is being prepared before an offer of employment has been made, under the Equality Act 2010 (EqA 2010)

The employer’s application for a medical report is likely to vary depending on:

1. •

   the purposes for which the report is being sought—see Data protection below

2. •

   whether the medical practitioner who will prepare the report is, or has been, responsible for the individual’s clinical care—see Access to medical reports—AMRA 1988 below

3. •

   the medical practitioner’s duties in