Information for staff > Data protection > Data protection guidance > Research  and the DP Act 1998

Research and the Data Protection Act 1998

The University of Edinburgh is a world-class research organisation. Some of the research undertaken by the University uses information about identifiable living individuals, for example research into the social skills of toddlers requires information about children, and medical research often requires patient information. The use of personal information for research falls within the remit of the Data Protection Act.

• For whom is this guidance intended?
• What is the purpose of this guidance?
• What is the Data Protection Act?
• Why should I concern myself with the Data Protection Act?
• What is personal data?
• What should I do if I want to use personal data for my research?
• How does the Data Protection Act affect my research?
• What help is available?

In this section:

• Researcher's checklist for compliance with the Data Protection Act - rtf
• Researcher's checklist for compliance with the Data Protection Act - PDF
• Annex A: Researcher's guide to the data protection principles
• Annex B: Consent form for personal data to be used for research - rtf
• Annex B: Consent form for personal data to be used for research - PDF

Related links:

• University Code of Good Practice in Research - pdf (link to ERI website)
• College of Humanities and Social Science Research Ethics Policy - doc (link to the College website)
• College of Humanities and Social Science Research Ethics Checklist - rtf (link to the College website)

For whom is this guidance intended?

This guidance is intended for all university staff who deal with research data about living individuals.

What is the purpose of this guidance?

This guidance is to raise awareness of the implications of the Data Protection Act for research data and to ensure you are able to comply with this legislation. The University of Edinburgh is a world-class research organisation. Some of the research undertaken by the University uses information about identifiable living individuals, for example research into the social skills of toddlers requires information about children, and medical research often requires patient information. The use of personal information for research falls within the remit of the Data Protection Act.

What is the Data Protection Act?

The Data Protection Act gives individuals (known as data subjects) rights regarding the personal data organisations hold about them and gives organisations responsibilities regarding that data. These responsibilities are codified as eight data protection principles. There are additional requirements for sensitive personal data, about which the University must be particularly cautious.

Why should I concern myself with the Data Protection Act?

• The University is committed to best practice in all areas of research, which includes conformity with the law. Information about the University’s commitment is detailed in the Code of Good Practice in Research,
  • http://www.research-innovation.ed.ac.uk/information/goodresearchpractise.pdf.
• In many respects the Data Protection Act reinforces the good practices promoted by professional bodies via their codes of ethics and standards of practice. For example the College of Humanities and Social Science Research Ethics Checklist, includes data protection considerations.
  • http://www.hss.ed.ac.uk/Research/documents/05NovconfirmedchecklistRTF.rtf
• The penalties for not complying with the Data Protection Act can be very serious. If the University is shown to be in breach of the Act it can be sued. This is expensive in terms of staff time, legal fees and any resulting award. In some cases individual members of staff may be found responsible resulting in a criminal record and a fine of up to £5,000.

What is personal data?

The Data Protection Act applies to personal data as defined on the records management website.

• http://www.recordsmanagement.ed.ac.uk/InfoStaff/DPstaff/PDDefinition.htm

If the data does not meet this definition, the Data Protection Act does not apply and there is no need for you to read further.

What should I do if I want to use personal data for my research?

If you want to use personal data for your research you have two options:

1. Comply with the Data Protection Act. Or
2. Anonymise the data that you use so that it no longer falls within the Act’s definition of personal data.

Option one

You must make arrangements to meet all of the requirements of the Act.

• See annex A: researcher’s guide to the data protection principles.

Option two

Where possible you may choose to completely anonymise the personal data you use. The data is only completely anonymised if it is impossible to identify the individuals from that information plus any other information that the University holds or is likely to hold. For example if you anonymise a list of patients by giving each patient a number and then keep a separate list of the numbers and the names of the patients to which they refer, the data is not completely anonymised and would still qualify as personal data under the Act. If you do not keep a “key” to the identities of the patients and it is not possible for the patients to be identified from any other information, for example sick leave data, that the University holds, or is likely to hold, then the data is completely anonymised. In this case you can use the data without making arrangements to comply with the Data Protection Act because the data will no longer fall within the Act’s definition of personal data.

If you are able to meet the requirements of option two and decide to anonymise your research data the rest of this guidance sheet does not apply to your research.

How does the Data Protection Act affect my research?

This guidance sheet will help you to comply with the Data Protection Act if you have decided to take option one.

The Act makes special provisions for research if your research fulfils all of the following conditions:

• You are using the information exclusively for research purposes (includes statistical or historical research purposes). The information must have no other use, not even an incidental use.
• You are not using the information to support measures or decisions relating to any identifiable living individual (not just the data subject but anyone who may be affected by your research).
• You are not using the data in a way that will cause, or is likely to cause, substantial damage or substantial distress to any data subject.
• You will not make the results of your research, or any resulting statistics, available in a form that identifies the data subjects. For example if you use case studies in your research report you may choose to disguise the names of the individuals. However, if you describe their circumstances in detail it may be possible for someone to identify that individual, in which case you would not meet this criterion.

This guidance sheet is written on the basis that your research does fulfil these conditions. If you cannot fulfil the conditions please contact the records management section as further obligations will apply. If you can fulfil the conditions you must comply with all of the requirements laid out in the Researcher’s guide to the data protection principles at annex A.  A checklist has been provided to help you.

• Annex A: researcher’s guide to the data protection principles
• Data protection checklist

What help is available?

The University Records Management Section provides advice, guidance and training on data protection, records management and freedom of information issues. For further information please refer to our website, or email us.

• http://www.recordsmanagement.ed.ac.uk
• Recordsmanagement@ed.ac.uk

Page last updated: Friday April 04 2008