At a glance
- The UK GDPR and the DPA 2018 contain provisions for processing personal data for research purposes.
- These provisions refer to three types of research-related purposes for processing personal data, which are:
- archiving purposes in the public interest;
- scientific or historical research purposes; and
- statistical purposes.
- The UK GDPR and the DPA 2018 do not set out the research provisions in one location. Instead, a number of articles and paragraphs in both pieces of legislation mention them.
- These provisions cover three broad areas of data protection, which are:
- the data protection principles;
- a condition for processing special category data and criminal offence data; and
- exemptions from individuals’ rights.
In detail
The UK GDPR and the DPA 2018 contain provisions for processing personal data for research purposes.
These provisions recognise the importance of scientific and historical research and technological development to society. They ensure that data protection requirements enable technological innovation and the advancement of knowledge.
The provisions refer to three broad types of research-related purposes for processing personal data. They are:
- archiving purposes in the public interest;
- scientific or historical research purposes; and
- statistical purposes.
For ease of reference, in this guidance we refer to these collectively as “research” or “research-related purposes” (although this is not a term that appears in the UK GDPR or the DPA 2018). Where the provisions differ depending on the specific type of research-related purpose, we refer directly to that purpose.
The UK GDPR and the DPA 2018 do not set out the research provisions in one location. Instead, a number of articles and paragraphs in both pieces of legislation cover research.
These provisions cover three broad areas of data protection, which are:
- the data protection principles;
- a condition for processing special category data and criminal offence data; and
- exemptions from individuals’ rights.
In order to use these provisions, you need appropriate safeguards in place to protect people’s rights and freedoms.
The table below sets out where you can find the research provisions and requirements about safeguards in the UK GDPR and the DPA 2018.
| Area of data protection law affected |
Location of research provision |
|
| Principles | Purpose limitation | Article 5(b) of UK GDPR: provision for research built into the principle |
| Storage limitation | Article 5(e) of UK GDPR: provision for research built into the principle | |
| Conditions for processing | Condition for processing special category data | Schedule 1 Paragraph 4 of DPA 2018 |
| Condition for processing criminal offence data | Schedule 1 Paragraph 4 of DPA 2018 | |
| Exemptions | Right to be informed when data collected from source other than the individual | Article 14(5)(b) of UK GDPR: exception for research built into the right |
| Right of access | Schedule 2 Paragraphs 27 and 28 of DPA 2018: exemptions for research and statistics, and archiving | |
| Right to rectification | Schedule 2 Paragraphs 27 and 28 of DPA 2018: exemptions for research and statistics, and archiving | |
| Right to erasure | Article 17(3)(d) of UK GDPR: exception for research built into the right | |
| Right to restrict processing | Schedule 2 Paragraphs 27 and 28 of DPA 2018: exemptions for research and statistics, and archiving | |
| Right to data portability | Schedule 2 Paragraph 28 of DPA 2018: exemption for archiving* | |
| Right to object |
Article 21(6) of UK GDPR: exception for scientific or historical research and statistics built into the right; and Schedule 2 Paragraphs 27 and 28 of DPA 2018: exemptions for research and statistics, and archiving** |
|
| Safeguards | Article 89 of the UK GDPR; Section 19 of DPA 2018 | |
*Schedule 2 of the DPA 2018 contains an exemption from the right to data portability for archiving purposes in the public interest only. There is no exemption from the right to data portability for scientific or historical research, or statistics.
** Article 21(6) contains a built in exception from the right to object to processing for scientific or historical research and statistical purposes only. However, Schedule 2 Paragraph 28 provides an exemption from the right to object when processing for the purposes of archiving in the public interest.