Guidance on the General Data Protection Regulation (GDPR) and data protection for social research

SUMMARY OF KEY POINTS

Research that uses or collects personal information about identifiable, living people must comply with data protection law, and ensure that the rights of ‘data subjects’ are protected.

The General Data Protection Regulation (GDPR) (EU) 2016 and the UK Data Protection Act (DPA) 2018 provide the framework for this, replacing the Data Protection Act 1998. The Act applies to all nations of the UK.

The sections of this guide cover the main aspects relevant to social research:

• There is a research exemption for some provisions (Sections 2 and 10 to 12).
• In a research context ‘data subjects’ are likely to mean research participants (Section 4).
• An important and early decision in the research process is to identify the data controller, the joint controller (if there is one), and the data processor. The controller and joint controller determine why and how personal data is processed. A processor carries out the processing on behalf of a controller (Section 5).
• Data controllers and joint controllers are responsible for determining the lawful basis or bases for the research, as well as other responsibilities (Section 6).
• Several lawful bases are available to data controllers for processing personal data. There is no hierarchy of bases and ‘consent’ may not always be the best choice. There are other bases that might be more appropriate, such as processing for ‘task in the public interest’ or ‘legitimate interests’. But high standards of ethical behaviour in research apply, and whether or not ‘consent’ is the lawful basis for processing personal data, you must follow ethical guidance on informed consent (Section 7).
• Data processors have certain responsibilities (Section 9).
• The GDPR permits some flexibility with data processing that is necessary for ‘scientific or statistical research purposes’ and is ‘in the public interest’. This applies to processing data; data subjects’ rights and notice requirements; and special category data. This is known as the ‘research exemption’ (Sections 10 to 13).

View the full pdf here