Cookies on this website

We use cookies to ensure that we give you the best experience on our website. If you click 'Accept all cookies' we'll assume that you are happy to receive all cookies and you won't see this message again. If you click 'Reject all non-essential cookies' only necessary cookies providing core functionality such as security, network management, and accessibility will be enabled. Click 'Find out more' for information on how to change your cookie settings.

Accept all cookies Reject all non-essential cookies Find out more

Lawfulness of data processing

Article 6 of the UK General Data Protection Regulation (see also Part 2, Chapter 2(8) of Data Protection Act 2018) sets out the legal basis for processing personal data, stating that processing is only lawful if at least one of six conditions is met. The most used lawful basis for data processing in research is a task in the public interest or for the exercise of official authority (Art. 6(1)(e) UK GDPR). Researchers may also seek explicit consent from the data subject (Art. 6(1)(a)

UK GDPR) but should be aware of potential constrictions if consent is later withdrawn. Consent under UK GDPR must be freely given, specific, informed, unambiguous, and demonstrable. Article 7 of the UK GDPR sets out the conditions for consent.

Healthcare data is protected under a special category of personal data, meaning it is subject to additional regulations within UK GDPR beyond those covered in Art. 6. There may be a lawful basis for the processing of these data if certain conditions are met (see Art. 9(2) UK GDPR), for example, if a participant explicitly gives their consent (Art. 9(2)(a)).

The legal frameworks for access to NHS data differ across the devolved nations. Individual data repositories may set different requirements for data access requests, but at the minimum, researchers must provide a valid legal basis to the data repositories for processing personal data. Data repositories may also recommend that, where possible, researchers obtain consent to access personal data from trial participants.

To access NHS England data when explicit consent has not been obtained, researchers can seek Section 251 support as part of their application. Section 251 of the National Health Service Act 2006 makes provisions for data controllers to be granted permission to share patient-identifiable data for medical research without explicit consent. For example, researchers can contact individuals identified through a health registry about an upcoming trial without explicit consent of the prospective participant with Section 251 support.

Researchers planning to seek access to NHS data held in Wales, Scotland, and Northern Ireland without explicit informed consent should refer to the relevant legislation and seek guidance from data custodians. These include the Confidentiality Advisory Group (England and Wales), the Public Benefit and Privacy Panel for Health and Social Care (Scotland), and the Honest Broker Service (Northern Ireland).