Data protection and GDPR
Plan lawful and proportionate data use
Data protection governs processing of personal data across collection, linkage, analysis, sharing and deletion. UK GDPR and EU GDPR are related but distinct legal regimes. Research provisions are conditional, not blanket exemptions. Ethical agreement to participate differs from consent as a data-processing lawful basis. Pseudonymised data can remain personal data; truly anonymised data require a defensible identifiability assessment.
Use whenever people can be identified directly or indirectly from research data, including linked administrative records, interview transcripts and online traces. Confirm the relevant jurisdiction and institutional data-protection requirements early.
Strengths
- Makes data flows, purposes and access responsibilities explicit
- Supports proportionate minimisation and controlled research reuse
Limitations
- Linkage can make apparently anonymous data identifiable
- Research exceptions and international transfers require case-specific assessment
Know the boundary
A research purpose is not itself a universal lawful basis; removing names is not enough to guarantee anonymity.