Guidance on sharing data about people as a research output

Purpose of this guidance

This guidance accompanies the UK Research and Innovation (UKRI) research data policy, which applies to in-scope funding opportunities published on or after 1 April 2027. It must be read together with the policy, which includes general requirements on managing restrictions on data sharing.

This guidance outlines specific considerations for sharing research data about people that has been generated, collected and processed as part of UKRI-funded research. These considerations should also be taken into account when planning research, including in funding applications for projects that will collect and share data about people.

The guidance supports the policy’s aims for research data to be:

responsibly made as open as possible, and as closed as necessary
findable, accessible, interoperable and reusable (FAIR)

This will support the transparency, integrity and value of publicly funded research.

What is 'data about people'

Research data (‘data’) is defined as recorded information that is collected, created, generated, observed or derived from existing sources through any research method, and used to support, validate or inform research findings.

Any data that can be potentially linked to an individual person (alive or dead), whether at an individual, population or organisation level, is categorised as data about people. This might include creating data from multiple sources (for example, linking administrative and financial records).

Some data originates from people, but is not ‘data about people’ in the context of this guidance. For example, many types of biological data (such as protein structures or viral genomic sequences) originates from people, but can no longer be linked to an individual. Similarly, environmental data (for example, air quality measurements) is only ‘data about people’ when it can be linked, directly or indirectly, to individuals.

Determining if data identifies individuals

Most of the factors that hinder or prevent sharing data about people relate to whether and to what extent the data is ‘identifiable’, that is, whether it can identify an individual. Data that is not identifiable is simpler to share, but identifiable data tends to retain greater research utility. Therefore, key to successful data sharing is establishing whether the data is identifiable or not.

Relevant guidance includes:

Broadly speaking, sharing data about people as a research output falls under one of three scenarios.

Scenario 1: sharing data within the spectrum of identifiability

Laws around identifiability are binary: data is either identifiable, or it isn’t. In practice, identifiability is more nuanced and falls within a spectrum, which is defined by the data’s content and context. This is not a static state, and there are several matters that must be addressed prior to data collection, access, and use, which will support subsequent data sharing. These include:

participant communication and consent: being open with people about how data about them will be shared and used
de-identification: reducing the risk of identification as far as is reasonable and in line with the access route, while preserving as much value in the data as possible
access control: matching the level of access (for example, open, safeguarded, or controlled access) to the residual risk in the data, so that more detailed data are shared under tighter controls, rather than not shared at all

When research involves data about people, these topics must be discussed and addressed, as far as possible, with data providers, funders, and research approval bodies to ensure that sharing data as a research output is possible.

Scenario 1a: data collected directly from people

This scenario covers situations where there is a direct interaction between the research team and the people that data will be, or has been, collected from. This may include clinical trials, population health research, surveys, questionnaires or interviews. It might be qualitative or quantitative, or a mixture of both.

In this scenario, identifiable research data is generally considered confidential, so to permit data sharing a legal avenue to allow disclosure is required (as described in guidance on using information about people in health research), either to share identifiable data, or to process the data to render it non-identifiable prior to sharing. Therefore, it is crucial that the research protocol, participant information sheets and consent forms describe and allow for data sharing as a research output.

For example:

consent must not restrict data sharing to a single institution, or state that data will not be shared beyond the research team
in broad terms, consent must be clear what data will be shared, for what purposes and with whom
consent should be transparent as to whether identifiable data will be shared or not
procedures must be in place to manage consent when data will be made available for the long-term, especially for certain populations (for instance children)

The Health Research Authority and the UK Data Service have produced guidance on these topics.

Appropriate and proportionate public involvement and engagement should inform what participant materials look like, and what type of data sharing is acceptable. Several organisations provide guidance about how to conduct public involvement. For example, The Public Engagement in Data Research Initiative work to develop best practice in health data sharing, and the Office for Statistics Regulation lists a range of resources.

In all cases, discussions and agreement with the repository where the data will be placed and made available must take place prior to data collection. This will help ensure that the consent obtained aligns with the requirements of the repository.

Scenario 1b: data collected indirectly from people

This scenario covers situations where there is no interaction between the research team and the people that data will be, or has been, collected from. This may include data collected on an ongoing basis (for instance, smart energy meter data, data collected by UK Biobank), or previously collected data held in trusted research environments (for instance, Administrative Data Research UK).

Consent (or other appropriate legal avenue) to share the data may or may not be in place. In this situation, sharing data as an output must be agreed in principle with the data provider as part of the data application process. For example:

establishing if any existing consent (or other legal avenue) applies to the data, and what this allows in terms of sharing data as an output
determining if there are any legal or contractual restrictions on sharing the data
making sure that data sharing agreements (or any other arrangements) allow the data to be shared
making sure that funding will be put in place to allow data sharing as an output

Where data about people cannot be made available as an output, a means to reconstruct the data must be agreed upon and made available. This should include:

the code and scripts used to build and curate the data (for example, data cleaning, linkage and derivation code)
clear documentation of data sources, variables, inclusion and exclusion criteria, and linkage methods
information about how others can apply to the data provider to access data, subject to approval

Also see the ‘responsibly managing and sharing data’ section of the UKRI research data policy.

Scenario 2: inherently anonymous data

Sometimes no individual could ever be identified from data, even if it is combined with other data and placed in the public domain. Most commonly this might apply to publicly available aggregate statistics, or anonymised record-level data (for example heavily treated or perturbed microdata or samples), or heavily aggregated qualitative summaries. Making this data available may be as simple as providing a link to the original data source.

Scenario 3: inherently identifiable data

There may be circumstances when it is not possible to control the likelihood of identification sufficiently to de-identify research data while retaining data utility (for example, production of social media or where attribution forms an essential part of the research record). When this is the case, consent should be obtained to allow data sharing. If it is not possible to obtain consent, data sharing may not be possible.

Reasons for not sharing data as a research output should be made clear during the funding application process. Sharing relevant code, workflow documentation and metadata remains compulsory (see the ‘responsibly managing and sharing data’ section of the UKRI research data policy).

The Five Safes framework

Sharing data about people must follow The Five Safes framework, which aims to protect the confidentiality and rights of research participants and the security of data, while determining the best means of sharing the data for research benefit.

The principles set out by the Five Safes are:

safe data: can data be anonymised while keeping the data usable?
safe projects: will research projects be approved for use in the public interest, in advance of use of the data?
safe people: who will access and use the data, and will they receive any training?
safe settings: is there an appropriate computing environment preventing and guaranteeing unauthorised use?
safe outputs: is there a likelihood that any statistical results could disclose the identity of a data subject and/or reveal confidential information about them?

Data access governance

Data access governance processes should be appropriate and proportionate to the nature and scale of the data, the level of risk and the likely demand for access. The criteria and processes governing data access should be transparent and readily discoverable.

Data access processes should include accountable independent input, and we strongly encourage public involvement in the data access process.

The Global Alliance for Genomics and Health and Health Data Research UK (HDR UK) has published guidelines on what data access transparency looks like in practice:

Transparency

Data that is identifiable and relates to the living is personal data, so the relevant data protection transparency information (as described in using information about people in health research) must also be clear (and kept up to date) in respect of how research data will be shared and used. This still applies even if data will be de-identified prior to sharing.

The Health Research Authority has data protection guidance and templates available, as does the UK Statistics Authority:

Data sharing agreements

Sharing data about people must only proceed with an appropriate data sharing agreement. Data sharing agreements set out what data can be shared and why, clarify roles and responsibilities, and specify what happens to data. They will be in place as part of repositories’ data sharing process. Data-sharing agreements must follow recognised standards.

Examples of guidance include:

Repositories

The UKRI research data policy requires data to be shared using an appropriate repository. This is important for sharing data about people as a research output, given the multiple policy, legal and technical requirements that need to be in place.

Setting up and managing appropriate infrastructure, governance and technical processes to make data about people safely available to the research community takes considerable expertise, effort and cost, and as such must be undertaken via an appropriate repository rather than research teams.

An appropriate repository may include a domain-specific repository, institutional repository or the original data provider. It may include trusted research environments, where needed. Repositories should adhere to the Five Safes framework.

There are domain-specific repositories that offer data sharing services for data about people. Examples include:

UK Data Service for economic, social research and population data
European Genome-phenome Archive and the BioImage Archive for life science data
Archaeology Data Service for archaeology and heritage data

MRC provides guidance on using data about people in research, which is also relevant to other UKRI-funded research involving data about people.

Our good research resource hub provides additional guidance and resources about open data and research, ethics and human participants in research.

Page viewed: 2:27 am on 15 October 2026