# UK GDPR and the Data Protection Act 2018 UK data protection law follows the data and processing activity. Using health data for purposes beyond individual care does not remove its protection. Storage, retrieval, disclosure, analysis and deletion are processing. The UK GDPR can apply even when processing occurs abroad. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) **Scope:** England, with UK-wide law. **Evidence checked:** 19 October 2026. **Status:** evidence-checked synthesis; independent legal review remains open. No actual service has been approved; the worked recruitment flow is a bounded illustration. Use this page with the separate [confidentiality rules](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md), [NHS standards](https://healthcare-data-management-wiki.pages.dev/nhs-standards/index.md) and [applicability assessment](https://healthcare-data-management-wiki.pages.dev/applicability/index.md). ## The central regime Apply the **UK General Data Protection Regulation (UK GDPR)** alongside the **Data Protection Act 2018**, both read with the **Data (Use and Access) Act 2025** amendments. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002) [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) ## Privacy and public authorities The Human Rights Act 1998 adds a public-law layer. Section 6 generally requires public authorities to act compatibly with Convention rights. Article 8 protects private and family life; interference requires a lawful and necessary justification within its permitted aims. Whether a private organisation exercises a public function is fact-specific. This is additional to the UK GDPR and confidentiality analysis. [SRC-076](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-076) [SRC-079](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-079) ## Classify the information first | Information | Legal significance | |---|---| | Personal data | Information relating to an identified or identifiable person. A name is not required; indirect identification can suffice. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) | | Health data | Personal data concerning physical or mental health, including healthcare provision that reveals health status. It is special-category data. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Inferred health data | Deliberately inferring health status, or treating someone differently on that inference, can trigger Article 9 even if the inference is uncertain. [SRC-024](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-024) | | Pseudonymised data | Replacing identifiers and separating the linking information reduces risk. It remains personal data for a holder able to identify people. [SRC-023](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-023) | | Anonymous information | Whether information is anonymous depends on identifiability in its context. A recipient may receive anonymous information while the sender retains identifiable data. [SRC-023](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-023) | | Criminal-offence data | This has separate Article 10 restrictions. It is not another Article 9 special category. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-024](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-024) | Confidential patient information is a separate legal classification. Do not use “personal data”, “health data” and “confidential patient information” as interchangeable terms. See [confidentiality](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md). UK GDPR does not apply to genuinely anonymous information. However, anonymising personal data is itself regulated processing. Removing direct identifiers alone is insufficient. Other rules or agreed use restrictions may still apply to an anonymous output. [SRC-097](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-097) ## Identify a lawful route for each purpose For personal data concerning health, the controller needs both an **Article 6 lawful basis** and an **Article 9 condition**. Applicable Data Protection Act 2018 safeguards also apply. A service contract or a general claim of public benefit does not supply both permissions. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) The recipient controller must justify its collection and subsequent use. The provider's lawful disclosure does not establish those grounds. A processor instead acts on its controller's instructions within the Article 28 framework. Use the [requester assurance assessment](https://healthcare-data-management-wiki.pages.dev/requester-assurance/index.md#what-is-the-underlying-legal-authority) to record the roles and grounds for each operation. [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) Article 6 includes consent, contract necessity, legal obligation, vital interests, public task, recognised legitimate interests and ordinary legitimate interests. Each has its own conditions. Public task must concern the controller's own legally grounded task. Recognised legitimate interests is limited to Annex 1. Public authorities cannot use either legitimate-interests basis when performing their public tasks. [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004) Article 6(1)(b) concerns a contract with the data subject, or steps requested by that person before entering a contract. A procurement contract between organisations is not enough. Nor does that basis supply the separate Article 9 condition. [SRC-004](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-004), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) The following Article 9 routes may be relevant. They are conditional routes, not a menu of labels to attach after processing starts. | Purpose or condition | Route and principal constraints | |---|---| | Explicit consent | Article 9(2)(a). Consent must meet the legal standard and permit withdrawal. A signature alone does not establish freely given consent. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Employment, social security or social protection obligations and rights | Article 9(2)(b), Schedule 1 paragraph 1. Processing must be necessary for legally imposed or conferred obligations or rights. An appropriate policy document is required. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Health or social care purposes | Article 9(2)(h), Schedule 1 paragraph 2, and Article 9(3) secrecy safeguards. This includes occupational medicine and health-system management. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Public health | Article 9(2)(i), Schedule 1 paragraph 3. Requires necessity, a public-health purpose in the public interest, and the specified professional or confidentiality safeguard. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Research, statistics or public-interest archiving | Article 9(2)(j), Schedule 1 paragraph 4. Requires necessity, public interest and Article 84B safeguards. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Substantial public interest | Article 9(2)(g). Identify the applicable legal condition, normally a precise Schedule 1 Part 2 condition. An appropriate policy document is usually required. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | | Other specific circumstances | Legal claims, vital interests and other Article 9 conditions may apply on their facts. They do not authorise routine processing by default. [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | The health or social care route can therefore apply to purposes beyond individual care. Its defined purposes and secrecy requirements still restrict it. It does not cover every commercial use of health records. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) ## Apply the principles throughout processing Article 5 requires lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability. A lawful basis does not remove these duties. [SRC-005](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-005) Recipient controllers must implement appropriate safeguards and demonstrate compliance, even when the provider states no conditions. Article 24 requires them to review and update those measures where necessary. A requester's assurance evidence should address the actual collection and use, rather than rely only on the provider's permission. [SRC-103](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-103), [SRC-098](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-098) Assess each proposed further use, including analytics, model training, product development and marketing. Article 8A governs compatibility with the original purpose. Compatibility does not remove the Article 6 requirement or the Article 9 condition. A lawful hosting arrangement does not itself authorise supplier reuse. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003), [SRC-014](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-014) ## Research has safeguards, not a general exemption Scientific research can include commercial activity if the activity can reasonably be described as scientific. The statutory definition does not make all product development scientific research. [SRC-001](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-001) Current research safeguards sit in **UK GDPR Chapter 8A**. Article 84B requires appropriate safeguards. Beyond collection or making data non-identifying, processing must be needed to fulfil the research, archiving or statistical purpose. [SRC-009](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-009) Article 84C prohibits reliance on these safeguards where processing is likely to cause substantial damage or substantial distress. It restricts individual measures or decisions, except for approved medical research. It also requires technical and organisational measures for data minimisation. [SRC-010](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-010) These provisions do not supply a separate confidentiality permission. Apply the [confidentiality assessment](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) as well. ## Automated decisions retain strict health-data rules Article 22A defines a solely automated decision by the absence of meaningful human involvement. The special rules concern decisions with legal or similarly significant effects. A nominal human approval is not enough if involvement has no meaning. [SRC-011](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-011) Under Article 22B, a significant decision based entirely or partly on special-category data cannot be solely automated unless: 1. The decision is based entirely on processing to which the person gave explicit consent; or 2. The decision is necessary for entering or performing a contract, or required or authorised by law, **and** Article 9(2)(g) applies. [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012) Article 22B separately prohibits significant solely automated decisions where the processing relies entirely or partly on recognised legitimate interests. Article 22C requires information, representations, human intervention and a route to contest the decision. [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012), [SRC-013](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-013) ## Use the law in force on the review date The Data (Use and Access) Act 2025 amended the existing framework. It did not replace UK GDPR and DPA 2018. [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) | Verified change | Consequence for this wiki | |---|---| | Most relevant Part 5 reforms commenced on 5 February 2026 | Use amended lawful-basis, research, automated-decision and transfer provisions. [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) | | The complaints provisions commenced on 19 June 2026 | Include an accessible complaints process and the statutory handling duties. [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006), [SRC-007](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-007) | | Regulator functions transferred on 30 September 2026 | The statutory body is now the Information Commission. The regulator's website continues to use “ICO”. [SRC-008](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-008), [SRC-006](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-006) | | Article 22 was replaced by Articles 22A–D | Do not use the previous general automated-decision prohibition as the current rule. [SRC-011](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-011), [SRC-012](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-012) | | Research safeguards moved to Articles 84A–D | Current Article 9(2)(j) and Schedule 1 paragraph 4 refer to Article 84B. [SRC-002](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-002), [SRC-003](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-003) | Some ICO guidance remains under review. Where older guidance differs, check the current statutory provision and record the issue in the [validation queue](https://healthcare-data-management-wiki.pages.dev/validation-queue/index.md). This wiki does not determine whether a particular organisation satisfies any conditional route. ## Jurisdiction boundary This wiki’s main analysis concerns UK GDPR. EU GDPR needs a separate check only if the service has relevant EU establishment, offering or monitoring connections under its Article 3. A person’s nationality alone does not settle that test. No such connection is assumed here. [SRC-078](https://healthcare-data-management-wiki.pages.dev/sources/index.md#src-078) ## Related pages - [Research home and governing question](https://healthcare-data-management-wiki.pages.dev/index.md) - [Confidentiality and secondary uses](https://healthcare-data-management-wiki.pages.dev/confidentiality/index.md) - [Data lifecycle and supplier duties](https://healthcare-data-management-wiki.pages.dev/data-lifecycle/index.md) - [Data (Use and Access) Act 2025 changes](https://healthcare-data-management-wiki.pages.dev/duaa-2025/index.md) - [Applicability assessment](https://healthcare-data-management-wiki.pages.dev/applicability/index.md) - [Evidence and source register](https://healthcare-data-management-wiki.pages.dev/sources/index.md)