What is research-related processing?
Latest updates
15 June 2023 - small amendment made to the definition of research activities to clarify our position on this issue.
At a glance
- The research provisions refer to three types of research-related purpose. They are:
- archiving purposes in the public interest;
- scientific or historical research purposes; and
- statistical purposes.
- To use the provisions, you need to demonstrate that your processing is necessary for one of these research purposes.
- We developed a set of indicative criteria for each of the three types of research.
In detail
- What is research-related processing?
- What is archiving in the public interest?
- What are some indicative criteria for archiving in the public interest?
- What is scientific or historical research?
- What are some indicative criteria for scientific or historical research?
- What is processing for statistical purposes?
- What are some indicative criteria for statistical processing?
What is research-related processing?
Research-related processing is processing you carry out for any of the following purposes:
- archiving purposes in the public interest;
- scientific or historical research purposes; or
- statistical purposes.
The legislation does not define these terms. However, the introductory recitals to the UK GDPR give them some additional detail. Recitals are not legally binding, but they are useful for understanding the meaning of the articles.
The defining feature of each of these research-related activities is the aim or purpose of your processing. This is key to determining whether the research provisions cover your processing. We developed descriptions of the aims and purposes of each type of research-related processing. We set these out in the sections below.
When determining whether your processing can legitimately use the research provisions, you should think carefully about whether it is necessary for achieving one of the research-related purposes.
We also developed some indicative criteria for each of the research-related purposes. These are non-exhaustive and show the types of activity indicative of each type of research purpose.
These criteria can help you identify which of your processing activities you can define as for research purposes. This then allows you to use the research provisions. Referring to them in your documentation of processing shows that you considered your use of the provisions. It also shows that you are confident they are necessary.
However, the key feature is the purpose or aim of your processing. You must demonstrate that your processing is necessary to meet the purpose or aim of your type of research.
What is archiving in the public interest?
Archiving in the public interest ensures the permanent preservation and usability of records of enduring value for general public interest.
The aim of archiving is to maintain information and provide long-term access to it for public use. However, archives often contain the personal data of living, identifiable individuals.
The UK GDPR and the DPA 2018 recognise that there is a public interest in permanently preserving some records containing personal data. There is a long-term benefit to society in doing so.
Archiving in the public interest is a service where organisations manage and preserve records identified as having potentially enduring public value. Organisations should not use the provisions for archiving to justify indefinite retention of records that have no potential public value, or retention without active and ongoing management.
Some bodies with specific legal obligations, such as the National Archives, National Records of Scotland and the Public Record Office of Northern Ireland, carry out archiving in the public interest. Public bodies, such as local authorities, may also have a public task set out in statute to maintain records archives.
However, many organisations undertaking archiving in the public interest are not under any statutory obligation to perform that task. Private or third sector organisations may also carry out archiving in the public interest.
You should distinguish archiving in the public interest from the long-term retention of records for business or legal purposes. Organisations sometimes use the term archiving to refer to sending records to offsite storage or moving data from a live system. However, for the purposes of the research provisions, if you are keeping records solely for current business or legal purposes, and they have no potential or confirmed enduring public value, then this is not archiving in the public interest.
The following table sets out examples of when we would consider the purpose of processing archiving in the public interest, and when we would not:
| Archiving in the public interest | Not archiving in the public interest |
|
|
What are some indicative criteria for archiving in the public interest?
To help you consider whether your processing is archiving in the public interest, we developed a non-exhaustive, indicative list of activities and features. Although the key factor is the aim or purpose, you should demonstrate that some of these activities are features of your processing.
Although you do not need to meet all of these criteria, we would expect you to meet more than one. The more of these criteria you can satisfy, the more likely it is that your processing is archiving in the public interest.
Ultimately, it is up to you to determine whether your processing is necessary for one of the research purposes. You must be able to justify this decision.
| Activities |
|
|---|---|
| Standards |
|
| Access |
|
Example
A charity has records of their activities dating back 150 years. The records document the charity’s support for vulnerable people and communities. They show a significant record of humanitarian work in the UK and beyond. Many of the people mentioned in the records are still alive, and so the collection contains personal data.
The charity does not employ an archivist and is not an accredited archive service. However, they do respond to occasional access requests from external parties. They are also exploring options to improve access to their collections in partnership with a local record office. The processing of this personal data is seen as archiving in the public interest.
The charity may decide to abandon their plans for improving access and stop answering enquiries. They could not then rely on archiving in the public interest to process the personal data.
Further reading – The National Archives
The National Archives is the official archive and publisher for the UK Government and for England and Wales. They published a guide to archiving personal data.
What is scientific or historical research?
Recital 159 of the UK GDPR gives some detail as to how organisations should understand scientific research:
“The processing of personal data for scientific research purposes should be interpreted in a broad manner including for example technological development and demonstration, fundamental research, applied research and privately funded research.”
Scientific or historical research has a broad meaning. It includes research carried out in traditional academic settings, and includes the full range of academic research including for example social sciences, humanities and the arts. It can also include research carried out in commercial settings, and technological development, innovation and demonstration.
As noted above, the key feature when determining if your processing can use the research provisions is your purpose or aim.
The OECD’s Frascati Manual says that the purpose of scientific or historical research is to increase the stock of knowledge. This includes knowledge of humankind, culture or society. It also says that the purpose of research is to devise new applications of available knowledge.
Scientific or historical research aims to:
- advance the state of the art in a given field or provide innovative solutions to problems;
- generate new understandings or insights that add to the sum of human knowledge in a particular area;
- support education; or
- produce findings of general application for testing and replication.
Scientific or historical research includes:
- fundamental or basic research – experimental or theoretical work undertaken primarily to acquire new knowledge of the underlying foundations of phenomena and observable facts, without any particular application or use in view;
- applied research – original investigation undertaken to acquire new knowledge, directed primarily towards a specific, practical aim or objective; and
- experimental development – systematic work, drawing on knowledge gained from research and practical experience and producing additional knowledge, which produces new products or processes, or improves existing products or processes.
This definition of research may include such activities as:
- research that informs policy and practice that does not necessarily result in published findings;
- the application and explanation of scientific research;
- demonstrating the replication or reproducibility of research;
- development of artificial intelligence (AI);
- research on real-world evidence; and
- secondary use of clinical trials data.
Public sector bodies may conduct scientific or historical research. But commercial or charitable organisations or independent researchers can also carry it out.
What are some indicative criteria for scientific or historical research?
We developed a non-exhaustive list of activities and features that are indicative of this kind of processing. Although the key factor is the aim or purpose, you should demonstrate that some of these are features of your processing.
Although you do not need to meet all of these criteria, we would expect you to meet more than one. The more of these criteria you can satisfy, the more likely it is that your processing is for scientific or historical research purposes.
Ultimately, it is up to you to determine whether your processing is necessary for one of the research purposes. You must be able to justify this decision.
| Activities |
|
| Standards |
|
| Access |
|
Example
A company provides biometric identity verification technology to businesses. They then use this technology to prove that their customers are who they say they are. The company processes the personal data of their clients’ customers. This is in the form of photographs of their faces. The company then determines whether the customer’s face matches their ID, and whether or not their ID is genuine.
The company becomes aware that their facial recognition technology is not responding to everyone equally. This is because of the broad diversity of facial characteristics across the world. The company decides to undertake research into how their algorithms can mitigate bias and treat everyone in a fair and inclusive manner.
The company carries out this research with appropriate safeguards in place for people’s rights and freedoms. The company only uses the outcomes of this research to train the algorithm to make better decisions in future.
This processing of personal data can be regarded as for scientific research purposes.
Example
A university establishes a research project to investigate the experiences of people who emigrated to the UK in the 1950s and 1960s. They also want to compare the experiences of people from different ethnic groups.
The processing of this personal data is for historical research purposes.
Further reading
The OECD’s Frascati manual provides an internationally recognised definition of research and development. It also provides guidelines for collecting and reporting data.
The Health Research Authority has produced detailed GDPR Guidance for Researchers and Study Coordinators.
The Medical Research Council Regulatory Support Centre has guidance on Using Data About People In Research.
UKRI has developed a Good Research Resource Hub which contains links to policies, standards and guidance for researchers.
The Market Research Society has developed a suite of support materials to help organisations comply with the UK data protection framework.
What is processing for statistical purposes?
Processing for statistical purposes is processing where the main objective is to generate statistics. It is important to note that not all processing that creates statistical results counts as processing for statistical purposes.
As noted above, the key feature when determining if your processing can use the research provisions is your purpose or aim.
Processing for statistical purposes refers only to activities where the processing’s primary aim or purpose is to produce statistical outputs. You may then use these statistical results for further purposes, including scientific research.
Public authorities and bodies with a statutory obligation to produce and disseminate official statistics, such as the Office for National Statistics, may conduct processing for statistical purposes. But it is also much broader than this. Private or third sector organisations may also carry out this processing. It covers any operation of collection and the processing of personal data necessary for statistical surveys or the production of statistical results.
For processing to count as for statistical purposes, the organisation doing the processing should either:
- not use the results to make decisions or justify measures about people; or
- render the results anonymous, making it no longer personal data.
You should note that if you hold other information that you could combine with the anonymised results, this could re-identify linked individuals. The results would no longer be truly anonymised, and would therefore count as personal data. This would mean that your processing could not count as for statistical purposes. However, if you were not using the information to make decisions or justify measures about people, then it would still count.
Further reading – ICO guidance
The ICO is currently working on new guidance on anonymisation, pseudonymisation and privacy enhancing technologies. We will add links to this guidance here when we publish it.
What are some indicative criteria for processing for statistical purposes?
The following is a non-exhaustive list of activities and features indicative of processing for statistical purposes. The key factor is the aim or purpose of your processing. However, you should also demonstrate that some of these are features of your processing.
Although you do not need to meet all of these criteria, we would expect you to meet more than one. The more of these criteria you can satisfy, the more likely it is that your processing is for statistical purposes.
Ultimately, it is up to you to determine whether your processing is necessary for one of the research purposes. You must be able to justify this decision.
| Activities |
|
|---|---|
| Outputs |
|
| Standards |
|
Example
A health agency is monitoring rates of COVID-19 reinfection. They collect the personal data of people who have tested positive for COVID-19. This includes data about previous infections. They use this data to generate statistics about the rates of reinfection. Other agencies then use this data to make policy decisions to try and reduce future reinfection rates.
The results of this processing are anonymous, and therefore do not contain any personal data.
The processing of this personal data is for statistical purposes.
Further reading – The National Archives
The UK Statistics Authority produced detailed guidance on GDPR and Statistics.