Data protection regulations and sharing research data

Data producer support home page

Data protection regulations and sharing research data

Different types of research data are subject to various UK data protection and access legislations depending on their content and the way they are used. For example, tabular data, such as surveys, administrative datasets and experimental results, may appear low risk, they can still contain identifiable or sensitive information; therefore, their processing is primarily governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where such datasets originate from government administrative sources, the Digital Economy Act 2017 and the Statistics and Registration Services Act may also regulate their sharing for statistical and research purposes.

Text data, including interview transcripts, policy documents or document corpora often contains rich, detailed information that may increase the risk of identifying individuals. Researchers must therefore take particular care to protect personal and sensitive information when sharing such data.

Additionally, policy documents held by public institutions may be subject to public access through the Freedom of Information Act 2000, while the Human Rights Act 1998 protects individuals’ rights to privacy when personal information is involved.

For image, audio and video data, such as photographs, recordings and filmed interviews, legislation again focuses on the protection of identifiable individuals. Because these formats may include facial images, voices or other identifiable characteristics, they are treated as personal data under the UK GDPR and the Data Protection Act 2018, with additional privacy protections under the Human Rights Act 1998. Spatial data, which include geographic coordinates or mapped features, may fall under the Environmental Information Regulations 2004 when they relate to environmental information held by public authorities. However, if spatial datasets reveal identifiable locations linked to individuals, the UK GDPR and Data Protection Act 2018 also apply.

Finally, relational data, such as network or graph-structured datasets describing relationships between individuals or organisations, can reveal identifiable connections between people. As a result, the processing and sharing of such data are primarily governed by the UK GDPR and the Data Protection Act 2018, alongside broader privacy protections established by the Human Rights Act 1998.

Following are some key considerations when sharing research data:

  • Lawful basis: Ensure a valid lawful basis under UK GDPR covers both data collection and future sharing.
  • Anonymisation: Remove direct identifiers and minimise risk of re-identification from combined variables if promised.
  • Informed consent: Clearly inform participants about data sharing and any limitations to confidentiality.
  • Confidentiality: Protect information provided in confidence and avoid disclosure of identifiable details.
  • Data minimisation: Share only the data necessary for research purposes, reducing unnecessary detail.
  • Access controls: Apply appropriate access levels (open, safeguarded, or controlled) based on risk.
  • Third-party restrictions: Check data use agreements or licences before sharing externally sourced data.
  • Documentation: Provide clear metadata and information on how the data has been processed and anonymised.

Data type Relevant legislation Why it applies
Tabular data (surveys, administrative datasets, experimental data) UK GDPR, Data Protection Act 2018, Digital Economy Act 2017, Statistics and Registration Services Act Survey or administrative datasets often contain personal or demographic information, so GDPR and DPA apply. If the data comes from government administrative sources, DEA and SRSA may govern its sharing for research and statistics.
Text data (transcripts, policy documents, corpora) UK GDPR, Data Protection Act 2018, Freedom of Information Act 2000, Human Rights Act 1998 Interview transcripts or written records may include identifiable personal data, triggering GDPR and DPA. Policy documents held by public institutions may be accessible under FOI, while HRA protects individuals’ privacy rights if personal information is included.
Image, audio and video data (recordings, photographs) UK GDPR, Data Protection Act 2018, Human Rights Act 1998 Images and recordings often contain biometric or identifiable information (faces, voices), which is considered personal data under GDPR and protected under privacy rights in the HRA.
Spatial data (geographic coordinates, maps) Environmental Information Regulations 2004, UK GDPR, Data Protection Act 2018 Spatial datasets about land, environment or geography fall under EIR if held by public authorities. If spatial data identifies individuals (e.g. home locations), GDPR and DPA also apply.
Relational data (network or graph data describing relationships) UK GDPR, Data Protection Act 2018, Human Rights Act 1998 Network data (e.g. social networks or organisational relationships) may reveal identifiable individuals or sensitive relationships, which are protected by GDPR/DPA and privacy rights under the HRA.