A laptop containing medical records of eight million patients has been missing for three weeks, according to the Sun newspaper, although the loss has only just been reported to the police.

The laptop, which is reported to be unencrypted, was one of 20 machines lost from a store room at London Health Programmes, a division of NHS North Central London (NHS NCL). In a statement, the NHS NCL confirmed the loss of "a number of laptops".

"One of the machines was used for analysing health needs requiring access to elements of unnamed patient data. All the laptops were password protected and our policy is to manually delete the data from laptops after the records have been processed," said NHS NCL, giving no details on the number of patient details that had been lost.

The Sun reported that although no names are contained by the records, postcodes, gender, ethnicity and medical information are included.

Data protection watchdog the ICO issued a statement soon after the data loss was revealed. "Any allegation that sensitive personal information has been compromised is concerning and we will now make enquiries to establish the full facts of this alleged data breach."

Serious breaches of the Data Protection Act can result in financial penalties of up to £500,000, administered by the ICO. The NHS NCL said it is taking the matter "extremely seriously".