Health-data research in the UK: UK GDPR, the DPA 2018, and the NHS

In the spring of 2020, with hospitals filling, a small team of epidemiologists and software engineers ran one of the largest health-data studies ever attempted — across the primary-care records of tens of millions of NHS patients — and no patient record ever left the data centers where it already lived. The platform was OpenSAFELY: analysis code traveled to the data, ran beside it, and returned only results.

That study is the clearest picture of where UK health-data research is heading. To see why it was built that way, you have to look at the unusual layered structure of British law underneath it.

Three layers of law, two separate tests

UK health-data research answers to three bodies of law at once, and the most common compliance mistake is assuming that satisfying one satisfies the others. A lawful study must pass data-protection law and the common-law duty of confidentiality — two independent tests with different logic, different gatekeepers, and different ways to fail.

After Brexit, the UK kept the GDPR's text in domestic law as the UK GDPR, with the Data Protection Act 2018 filling in the national details. The European Commission granted the UK an adequacy decision in 2021, so data still flows from the EU — a quieter dependency than it sounds, and one reason UK reform debates keep one eye on Brussels. The wider problem of moving health data between jurisdictions is its own story, told in why health data can't just cross borders.

What UK GDPR and the DPA 2018 ask of research

The data-protection test has two parts. First, a lawful basis: for NHS bodies and universities this is usually the public task basis, not consent — a surprise to many patients, but deliberate, because data-protection consent that patients can withdraw at any moment sits awkwardly with statistical integrity. Second, because health data is special-category data, the study needs an Article 9 condition; research typically relies on the scientific-research condition, which the DPA 2018 binds to safeguards echoing Article 89 of the GDPR: the processing must not be used to make decisions about the people in the data, must not cause them substantial damage or distress, and must use no more identifiable data than the question requires.

The ICO publishes detailed guidance on how these research provisions work in practice. The structure will feel familiar to anyone who has read our walkthrough of what GDPR Article 9 really permits — the UK kept the architecture and adjusted the furniture.

The duty of confidentiality and Section 251

Here is the layer that has no EU equivalent. Information a patient shares with a clinician is held under a common-law duty of confidence — judge-made law, older than any data-protection statute and entirely separate from it. Disclosing confidential patient information for research needs one of three keys: the patient's consent, data that no longer identifies anyone, or a legal gateway.

The main gateway is Section 251 of the NHS Act 2006. It allows the duty of confidentiality to be set aside for defined medical purposes, including research, when seeking consent is not practicable — think of a study needing thirty years of records from patients long lost to follow-up. Applications go through the Confidentiality Advisory Group at the Health Research Authority, which weighs whether the public interest justifies the intrusion and what conditions to attach. It is a narrower, sharper question than a research-ethics committee asks, though the two reviews often run side by side — the ethics half of the machinery is the subject of what an IRB actually does.

The national data opt-out — and the scar tissue behind it

Since 2018, patients in England have held a national data opt-out: a single registered choice that blocks the use of their confidential patient information for purposes beyond their own care, including research uses that rely on Section 251. It does not touch anonymized or aggregate data, and a few narrow exemptions apply, but where it applies it is binding.

The opt-out is scar tissue. An earlier program, care.data, set out in 2013 to centralize GP records for secondary uses and collapsed within three years under public objection — communication was poor, the controls were unclear, and trust drained faster than it could be rebuilt. The opt-out, and much of the caution in today's system, is what grew back. The lesson was not that the public opposes research; it was that defaults imposed without a credible way to say no eventually meet an expensive way of saying it.

Secure data environments: the direction of travel

The emerging settlement is architectural rather than contractual: stop shipping copies of NHS data to researchers, and bring researchers to the data instead. The 2022 Goldacre review made the case in detail, and NHS policy has since pointed firmly toward secure data environments — platforms where approved analysts work on data in place, every query is logged, and only vetted, non-identifying outputs leave. OpenSAFELY demonstrated the model under the worst possible conditions and published its code while doing so.

A secure data environment is, in effect, a national-scale version of the pattern we describe in federated analytics: the question travels, the records stay, aggregates come back. It converts much of the legal weight above — confidentiality, minimization, the opt-out — from paperwork into properties of the machinery.

That is also the shape Mithras Health is built to, with UK GDPR named among the regimes the platform is designed for. Federated queries run in-region and return aggregates only, which is the same contract a secure data environment enforces; a hard k ≥ 5 floor keeps any returned aggregate from shrinking into a person; and an append-only, cryptographically anchored audit trail records every grant, query, and refusal.

Where Mithras runs ahead of the UK baseline is consent. Rather than defaults plus an opt-out, every study on the platform is authorized by the patient it concerns — a revocable, scope-limited consent, made once per study and reversible at any time. Under English law that choice does double duty: explicit consent is simultaneously the cleanest answer to the duty of confidentiality and a valid Article 9 condition, cutting through both legal tests with a single, honest question.

The UK spent a decade learning, at the cost of care.data, that the public's trust is the rate-limiting reagent in health research. The systems now winning that trust back share one design conviction: the surest way to protect a record is to make the answer travel instead.