Using personal data in research: updated guidance

The UK Information Commissioner’s Office (ICO), has published draft guidance on the research, archiving and statistics (RAS) provisions of the UK GDPR and Data Protection Act 2018, following the updates from the Data (Use and Access) Act 2025. The draft guidance is open for consultation until 27 April 2026.  

For those who operate within industries which use personal data for research and development, this guidance and the change in the law is particularly helpful. The key benefit is  that in some circumstances, and with appropriate safeguards in place, personal data used for research may be reused for other research purposes. This needs to be assessed on a case-by-case basis, as the benefits may not always be available.

Organisations may need to carry out additional work to ensure that they can correctly rely on the RAS provisions. However, given that the possibilities and benefits of research are not necessarily known at the outset (for example in relation to use within artificial intelligence tools), these RAS provisions have the potential to provide much welcomed flexibility.

Defining research-related provisions

The ICO sets out four types of research-related purposes which may be subject to the RAS provisions. These ‘RAS purposes’ are:

• archiving in the public interest;
• scientific research;
• historical research; and
• statistical purposes.

Archiving in the public interest

Archiving in the public interest refers to the permanent preservation of records that hold enduring value for society. The purpose is to maintain long-term access to important historical, cultural, or government information. The ICO makes clear that keeping records for current business needs, legal purposes, or records without enduring public value will not be considered as archiving in the public interest.

Scientific research

The definition of scientific research is very broad and can include publicly or privately funded research, whether carried out as a commercial or non-commercial activity. It includes all areas of academic research such as social sciences, humanities and the arts. In order to benefit from the RAS provisions, scientific research should meet four criteria for processing, namely:

1. Having a scientific objective – such as a meaningful improvement in science or technology. In the area of public health, it must be ensured that the research serves the public interest.
2. Conducted with a scientific method – which should include ensuring that it is well planned, documented and systematically carried out, while following ethical standards for the field.
3. Uncertainty – the research should aim to solve a problem, where the outcome is not obvious in advance.
4. Transferability – means ensuring that the research produces new knowledge that could be shared with or used by others.

Historical research

As UK data laws only apply to living individuals, a great deal of historical research may fall outside the scope of the UK GDPR. However, where the personal data of living people is used, it may be possible to rely on the RAS provisions. Historical and scientific research may have different methods and approaches. However, the ICO states that if a researcher carrying out historical research wants to use the RAS provisions, the criteria given above should be met in a demonstrable way.

Statistical purposes

This covers statistical surveys or producing statistical results. The results must be anonymous, aggregate data which no longer contain personal data. Additionally, personal data used or any results must not be used to make decisions about the people whose information it belongs to.

RAS requirements and safeguards

The ICO sets out specific requirements connected to the RAS purposes, including:

• demonstrating that processing for RAS purposes, apart from collection or anonymisation, is essential;
• having appropriate safeguards in place;
• having technical and organisational measures in place to ensure compliance with the principle of data minimisation;
• where possible, research must be carried out using anonymous, or if not possible, pseudonymous data.

The RAS provisions cannot be relied upon if processing is likely to cause substantial damage or distress or is to be used to make decisions in respect of the people whose information is being used (unless it is approved medical research).

RAS benefits and exemptions

In what is a very helpful move for researchers, existing personal data may now be reused for RAS purposes, if there are appropriate safeguards in place.

However, the lawful basis is still important. If researchers are reusing personal information for RAS purposes, but the information was originally collected on the basis of consent for a different purpose altogether, fresh consent must be sought.

If personal information was originally collected on the basis of consent to carry out a particular research project, it is possible to be able to use it for another research project. Normally, consent must be for specific processing activities, but the law recognises that in a research context it may not be possible to identify all specific research purposes when the data is collected. However, researchers should identify the areas of research and where possible give individuals the option to only consent to certain research projects.

Researchers may also keep personal data indefinitely if it is processed solely for RAS purposes and appropriate safeguards are in place. It is vital that this personal data is not used for another purpose or used to make decisions about the individuals that the data concerns.

The draft guidance additionally provides more detail on how specific data rights have exemptions in connection with research related processing. Certain data rights have built-in exemptions for research, while others have an exemption if complying with the right would undermine the research. Exemptions must be considered on a case-by-case basis and should not be universally applied. If a researcher can comply with an individual’s rights without undermining the research, then they cannot rely on an exemption. Where seeking to rely on an exemption, it must be documented and this must be available for the ICO’s review on request.

Conclusion

Researchers will undoubtedly enjoy the greater flexibility for use of personal data in connection to RAS purposes. While the ICO’s draft guidance will entail further compliance analysis, steps, and documentation for organisations seeking to rely on these RAS provisions, especially in relation to scientific research, in practice this is unlikely to be overly burdensome, especially taking into account the likely benefits. It is worth noting that these provisions are UK-specific and therefore those subject to the EU GDPR will need to consider the separate requirements that apply without the flexibility introduced by the UK.