We are creating a unified UKRI website that brings together the existing research council, Innovate UK and Research England websites.
If you would like to be involved in its development let us know.

Site search

UK Data protection law and the common law of confidentiality

In the UK, the use of identifiable information is governed by:

UK Data protection law - ‘UK GDPR’ sits alongside the Data Protection Act 2018 to form primary data protection law in the UK.  UK GDPR retains very similar principles, rights and obligations to those found in EU GDPR (and if you collaborate with researchers in Europe, then EU GDPR may still directly apply to you).

On 28 June 2021 the EU granted adequacy to the UK.  Adequacy means that Personal Data can continue to flow freely between the UK and the EEA. (The UK recognised the EU and EEA member states as ‘adequate’ in 2020). The EU’s adequacy decisions for the UK are expected to last until 27 June 2025, with review by the EU planned in 2024.  You can learn more in the ICO's Adequacy guidance.

Common law - The requirement to respect any duty of confidence when accessing or sharing confidential information for health research, also applies in the UK. Learn more about confidentiality (PDF, 239KB).

You’ll find a summary of requirements in GDPR and Research – An Overview for Researchers.

Key facts

Whilst researchers have an important role to play (e.g. in respecting confidentiality and being clear, open and honest about how they intend to use data), ultimately, organisations are responsible for compliance with GDPR.

Learning resources

Further information

Still have a question?

If you have a specific question about how data protection and/or confidentiality law apply for research which we haven’t answered here, you can ask us at: rsc@mrc.ukri.org.