The General Data Protection Regulation (GDPR) has introduced some significant changes to the processing of data in health and care services. The impact of these changes is now being felt on a wider basis in relation to the question of whether data is processed with consent or not, and even whether we should continue to use the word ‘consent’ when sharing information to provide care. Also, there is the question of whether we should fundamentally review the concept of confidentiality and assess if the laws on data protection and privacy are sufficient on their own.