skip to primary navigationskip to content

Data Protection Act

In the UK, there are legal constraints on the collection and use of personal data. These legal constraints apply to academic research just as much as they do to businesses and public bodies. If your research requires you to keep any personal information about your participants (for example, their names), the Data Protection Act will apply to you.

The Act is interpreted by the Information Commissioner’s Office (ICO), an independent authority set up to uphold public information rights and data privacy for individuals. The implications of the Act are explained in the following ICO guidance:

Key points for researchers are as follows:

  • You must have permission from individuals to collect personal data. If this is not done explicitly (for example by signing a consent form), it may take the form of a Privacy Notice. Regulations about Privacy Notices are quite precise - if you plan to follow this route, you need to investigate further.
  • Whether using a consent form or a privacy notice, you must be clear from the outset about why you are collecting personal data and what you intend to do with it (the 'original purpose').
  • If you wish to use the data for any purpose additional to, or different from, the original purpose, the new use must be fair. For researchers, this means that it may be illegal to keep research data and use it for subsequent projects, if that data includes personal data.