UK GDPR and health data in research recruitment

This is a plain language summary for research teams, not legal advice. Where your study is regulated or your organisation has a data protection officer, they get the final word.

Key points

• Health information is special category data under UK GDPR.
• Research participation and data processing need separate, clear explanations.
• Collect only what the study genuinely needs.

Two permissions, not one

Under UK GDPR, processing personal data requires an Article 6 lawful basis. Health data is special category data and also requires an Article 9 condition. [1]

Possible routes include public task or legitimate interests under Article 6, and qualifying scientific research or explicit consent under Article 9. The correct combination depends on the controller, purpose and safeguards, so it should not be assumed from whether a study is academic or commercial. [1]

Whichever you use, write it down before recruitment starts. Committees ask, and so do participants.

Consent for data is not the same as consent to take part

Ethical consent to participate and the lawful basis for processing personal data are separate concepts, even when information about both appears together. [2] Keep them clearly separated in your information sheet so that withdrawing from the study and objecting to data processing are both possible and both explained.

Collect less

The strongest data protection measure is not collecting the field. For most studies you do not need a name, a full address or a date of birth. An age band and a participant ID will do. If you need a postal address for a product send, collect it separately, use it once, and delete it.

Pseudonymised is not anonymous

If additional information can reconnect a response to a person, the data is pseudonymised and remains personal data. [3] Say so accurately in your paperwork. Claiming full anonymity when a mapping exists is a common and avoidable error.

What participants can ask for

Be ready to answer requests for access, correction, deletion and objection, and say in the information sheet how someone makes one and how quickly you will respond. Some research-related exemptions may apply when their statutory conditions are met, but they are not automatic and must be considered case by case. [4]

A short recruitment checklist

• Lawful basis and Article 9 condition recorded.
• Privacy information given before any data is collected, in language a non-specialist can read.
• Data minimised, with a written justification for every special category field.
• Retention period set, with a deletion date, not "as long as necessary".
• Any processor, including a recruitment platform, covered by a written agreement.
• A named contact for questions and complaints, and a note that the ICO can be contacted.

For how this fits into the wider recruitment picture, read Recruiting for women's health research. FeFe's own handling of participant data is set out in the privacy notice and the data processing agreement.

References

1. Information Commissioner’s Office. What are the conditions for processing special category data?
2. Health Research Authority. Consent in research and data protection law.
3. Information Commissioner’s Office. Pseudonymisation.
4. Information Commissioner’s Office. Research provisions in data protection law.