A lot do but the simple answer is that if they took data protection seriously that would eat into their cost model and any money that they make.

GP’s are independent contractors and until their contract basically says “We expect you to mirror larger NHS organisations” the majority will never make any improvements, including something as simple as the privacy notices on their websites.

It is also part of the reason why some GP Federations and shared services are now going bust – the money was never really there to sustain them even as not for profit.