UK GDPR and the Data Protection Act 2018

UK data protection law follows the data and processing activity. Using health data for purposes beyond individual care does not remove its protection. Storage, retrieval, disclosure, analysis and deletion are processing. The UK GDPR can apply even when processing occurs abroad. SRC-001

Scope: England, with UK-wide law. Evidence checked: 19 October 2026. Status: evidence-checked synthesis; independent legal review remains open. No actual service has been approved; the worked recruitment flow is a bounded illustration.

Use this page with the separate confidentiality rules, NHS standards and applicability assessment.

The central regime

Apply the UK General Data Protection Regulation (UK GDPR) alongside the Data Protection Act 2018, both read with the Data (Use and Access) Act 2025 amendments. SRC-001 SRC-002 SRC-006

Privacy and public authorities

The Human Rights Act 1998 adds a public-law layer. Section 6 generally requires public authorities to act compatibly with Convention rights. Article 8 protects private and family life; interference requires a lawful and necessary justification within its permitted aims. Whether a private organisation exercises a public function is fact-specific. This is additional to the UK GDPR and confidentiality analysis. SRC-076 SRC-079

Classify the information first

Confidential patient information is a separate legal classification. Do not use “personal data”, “health data” and “confidential patient information” as interchangeable terms. See confidentiality.

UK GDPR does not apply to genuinely anonymous information. However, anonymising personal data is itself regulated processing. Removing direct identifiers alone is insufficient. Other rules or agreed use restrictions may still apply to an anonymous output. SRC-097

Identify a lawful route for each purpose

For personal data concerning health, the controller needs both an Article 6 lawful basis and an Article 9 condition. Applicable Data Protection Act 2018 safeguards also apply. A service contract or a general claim of public benefit does not supply both permissions. SRC-002, SRC-003, SRC-004

The recipient controller must justify its collection and subsequent use. The provider's lawful disclosure does not establish those grounds. A processor instead acts on its controller's instructions within the Article 28 framework. Use the requester assurance assessment to record the roles and grounds for each operation. SRC-003, SRC-004, SRC-014

Article 6 includes consent, contract necessity, legal obligation, vital interests, public task, recognised legitimate interests and ordinary legitimate interests. Each has its own conditions. Public task must concern the controller's own legally grounded task. Recognised legitimate interests is limited to Annex 1. Public authorities cannot use either legitimate-interests basis when performing their public tasks. SRC-004

Article 6(1)(b) concerns a contract with the data subject, or steps requested by that person before entering a contract. A procurement contract between organisations is not enough. Nor does that basis supply the separate Article 9 condition. SRC-004, SRC-003

The following Article 9 routes may be relevant. They are conditional routes, not a menu of labels to attach after processing starts.

The health or social care route can therefore apply to purposes beyond individual care. Its defined purposes and secrecy requirements still restrict it. It does not cover every commercial use of health records. SRC-002, SRC-003

Apply the principles throughout processing

Article 5 requires lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. A lawful basis does not remove these duties. SRC-005

Recipient controllers must implement appropriate safeguards and demonstrate compliance, even when the provider states no conditions. Article 24 requires them to review and update those measures where necessary. A requester's assurance evidence should address the actual collection and use, rather than rely only on the provider's permission. SRC-103, SRC-098

Assess each proposed further use, including analytics, model training, product development and marketing. Article 8A governs compatibility with the original purpose. Compatibility does not remove the Article 6 requirement or the Article 9 condition. A lawful hosting arrangement does not itself authorise supplier reuse. SRC-001, SRC-003, SRC-014

Research has safeguards, not a general exemption

Scientific research can include commercial activity if the activity can reasonably be described as scientific. The statutory definition does not make all product development scientific research. SRC-001

Current research safeguards sit in UK GDPR Chapter 8A. Article 84B requires appropriate safeguards. Beyond collection or making data non-identifying, processing must be needed to fulfil the research, archiving or statistical purpose. SRC-009

Article 84C prohibits reliance on these safeguards where processing is likely to cause substantial damage or substantial distress. It restricts individual measures or decisions, except for approved medical research. It also requires technical and organisational measures for data minimisation. SRC-010

These provisions do not supply a separate confidentiality permission. Apply the confidentiality assessment as well.

Automated decisions retain strict health-data rules

Article 22A defines a solely automated decision by the absence of meaningful human involvement. The special rules concern decisions with legal or similarly significant effects. A nominal human approval is not enough if involvement has no meaning. SRC-011

Under Article 22B, a significant decision based entirely or partly on special-category data cannot be solely automated unless:

1. The decision is based entirely on processing to which the person gave explicit consent; or
2. The decision is necessary for entering or performing a contract, or required or authorised by law, and Article 9(2)(g) applies. SRC-012

Article 22B separately prohibits significant solely automated decisions where the processing relies entirely or partly on recognised legitimate interests. Article 22C requires information, representations, human intervention and a route to contest the decision. SRC-012, SRC-013

Use the law in force on the review date

The Data (Use and Access) Act 2025 amended the existing framework. It did not replace UK GDPR and DPA 2018. SRC-006

Some ICO guidance remains under review. Where older guidance differs, check the current statutory provision and record the issue in the validation queue. This wiki does not determine whether a particular organisation satisfies any conditional route.

Jurisdiction boundary

This wiki’s main analysis concerns UK GDPR. EU GDPR needs a separate check only if the service has relevant EU establishment, offering or monitoring connections under its Article 3. A person’s nationality alone does not settle that test. No such connection is assumed here. SRC-078

Related pages

• Research home and governing question
• Confidentiality and secondary uses
• Data lifecycle and supplier duties
• Data (Use and Access) Act 2025 changes
• Applicability assessment
• Evidence and source register