We use cookies to improve your online experience. For information on the cookies we use and for details on how we process your personal information, please see our cookie policy and privacy policy. By continuing to use our website you consent to us using cookies. Continue

Data Protection in Research

Compliance Knowledge Base | Data Protection

Posted by: Lauren Hockley Published: Wed, 15 Aug 2018 Last Reviewed: Wed, 15 Aug 2018
Data Protection in Research

Research involves the collection, processing and analysis of data. As such, a great proportion of researchers will spend their days handling personal and/or sensitive data. If you are in the UK, this means dealing with such data will require compliance with the Data Protection Act (DPA) 2018, which is the UK's implementation of the General Data Protection Restrictions (GDPR). Data protection compliance is regulated by the Information Commissioner's Office (ICO). Not only do data breaches risk sizable fines, but they can also serve to damage the reputation of the researcher and the organisation they are employed by. To protect your organisation from the devastating effects of data breaches, it's important that researchers undergo regular data protection training and understand what steps to take to protect data under the law.

Types of Data

Researchers handle a range of data types. The DPA 2018 regulates the use of personal data and special category data. Personal data is any information relating to a living, identified or identifiable person. Special category data is data that is regarded as more sensitive and is consequently subject to tighter restrictions. Examples of this type of data include: racial/ethnic origin, health or sex-life information, political opinions, and religious beliefs. This type of data may, for instance, be used in health research, and must be gathered and processed according to the directives laid out in Article 9 of the GDPR. Amongst other things, this article states that explicit consent must be given by the data subject for in order for their data to be processed.

Data Protection in Research

The Issue of Consent

Data Protection legislation guides researchers to implement best practices, such as that of informed consent. Consent must be informed (consent given with the knowledge of the purposes for which their data will be used and/or transferred to), voluntary (consent should not be coerced), and fair (the individual should be given all/any supplementary information to ensure full transparency).

Whilst Data Protection regulation can seem overwhelming, especially regarding special category data. Following procedures of best practice and undertaking regular data protection training and refresher training can help keep compliance fresh in the minds of researchers.

Safeguard and Best Practices for Reseachers

There are a number of safeguards in place designed to protect the personal data of research participants. Research must receive approval from a research ethics committee. Data processing should be limited to what is strictly necessary (this is what is known as data minimisation). All who handle personal data should be literate in the principles of confidentiality and data protection. Data should be anonymised/pseudonymised wherever possible. If data is anonymised in line with the ICO's 'Anonymisation Code of Practice' then it is no longer regarded as personal data. However, it is important to recognise that the act of anonymisation is still classed as processing personal data.

Why is Data Protection Important in Research?

Improper data protection practices can result in a data breach. Data breaches can have unprecedented effects on both the data subjects (those whose data is stored and processed) and the organisations or individuals charged with protecting the data. The ICO can issue monetary penalties up to €20,000,000 or 4% of your annual turnover, whichever is greater, for data breaches where fault is determined.

Breaches can also quickly become tabloid scandals, and culminate in massive damage to your reputation or that of your employee. Given the potentially crippling effects that a data breach could have on your organisation and career, it is clear the importance that thorough data protection training has to play.

Most importantly, a data breach could result in damage to the rights, freedoms and privacy of your data subjects.

Get in Touch

* Required Field

Get in Touch

Get in Touch

Get in Touch

+44 (0)1509 611 019

We'd love to talk to you about how we can help. Please leave your details below and a member of our team will get back to you.

* Required Field

Get in Touch