https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/confidentiality-advisory-group/

If you intend to access confidential patient information without consent in England and Wales you should apply to the Confidentiality Advisory Group (CAG). You will need to apply whether your project is managed as research or non-research.

https://www.hra.nhs.uk/hra-guidance-general-data-protection-regulation/

How to ensure that your research data is managed in line with current European regulation

https://www.hra.nhs.uk/planning-and-improving-research/policies-standards-legislation/data-protection-and-information-governance/gdpr-guidance/templates/transparency-wording-public-sector/

https://www.hra.nhs.uk/approvals-amendments/what-approvals-do-i-need/research-ethics-committee-review/applying-research-ethics-committee/

comprehensive advice and guidance on applying, whether you can go for proportionate review etc

https://www.hra.nhs.uk/planning-and-improving-research/

The HRA website has lots of really useful information that can help you get started.