Using data about people in research

Data and confidentiality law

In the UK, the use of identifiable health information is primarily governed by the common law of confidentiality and data protection law.

Common law requires researchers to respect any ‘duty of confidence’ when accessing or sharing confidential information. Find out more about the common law of confidentiality in the Medical Research Council (MRC) ethics series.

Data protection law is formed from multiple pieces of legislation that relate to the processing of personal data. In terms of research, there are several key facts.

Key facts

Personal data

Personal data is data that relates to an identified or identifiable natural person, either directly from the data itself, or indirectly from combination with other available data. The Information Commissioner’s Office (ICO) provides detailed guidance on personal data.

Identifiability

If an individual can be distinguished from other individuals, then that person is ‘identified’ or ‘identifiable’. Whether a research dataset is identifiable or not is dictated by its content and the context. Find out more about identifiability in this guidance.

Pseudonymisation and anonymisation

It’s important to deidentify research data wherever possible to maintain privacy. By adequately controlling both content and context it can be possible to render deidentified data anonymous and therefore not personal data. To find out more see MRC e-learning and the ICO anonymisation guidance.

Responsibility

Researchers have an important role to play in protecting data, for example, in respecting confidentiality and being clear, open and honest about how they intend to use data. However, their organisations are responsible for compliance with data protection law.

Controllers

In health research the sponsor is likely to be a (data) controller. Find out more about current thinking on controllers and processors in health research.

Lawful

For research the data protection ‘lawful basis’ for processing personal data is likely to be either:

public task’ (NHS, universities and UK Research and Innovation institutes)
legitimate interests (charity and commercial organisations)

There is an additional condition for special category data of ‘research purposes’. See our data protection animation (YouTube).

Consent

Consent is important in research and for managing disclosures of confidential information. For research in the UK, it is unlikely to be the lawful basis for processing personal data under data protection law.

Safeguards

To process personal data for research appropriate safeguards must be in place. This can be managed if you follow the relevant policies and good research governance practices.

Data minimisation

Researchers should minimise the use of personal data to what is adequate, relevant and necessary to conduct the research.

Fair and transparent

Being fair and transparent with research participants about how personal data is processed is important. You can learn more from the ICO’s right to be informed guidance.

Storage

There is no legal requirement to delete research data. In fact, the ICO says you can keep ‘personal data’ for research indefinitely subject to ‘safeguards’. You can find further guidance on this in the MRC retention framework for research data and records.

Sharing data

Data protection doesn’t prevent data being shared, although confidentiality has to be managed in line with common law. Sharing personal data internationally requires extra consideration. Guidance is available from the ICO.

Data protection impact assessments (DPIA)

DPIAs are an organisational tool. They aren’t usually required for individual research projects. Learn more in Health Research Authority DPIA guidance.

Learning resources

More information is available at:

Questions about using data in research

If you have a question about using data in research that we haven’t addressed here, contact:

Email: researchpolicy@mrc.ukri.org

Last updated: 10 August 2026

Using data about people in research - MRC