This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies.

Find out more here.

It's important that you explain to people how you will be using their personal data, and what their rights are under the law.

The HRA has produced recommended wording to fulfill transparency requirements under the General Data Protection Regulation for health and care research

This information should be provided through relevant routes for participants, depending on the nature of the study. In some cases, sites (eg NHS organisations) should disseminate information from sponsors, as participants may not be aware of the sponsor. Options for dissemination include organisation/unit/study websites, posters and leaflets in clinics, in appointment and clinic letters, and study-specific materials. Sites may provide generic information about use of personal information in research that point to sponsor information providing more details. NHS sites are already expected to publish information about studies they are participating in; this can be supplemented by information about use of personal data, including details of the sponsor (and therefore data controller) for each study.

The text provided for use at unit/department/organisation level is intended to provide key information specific to health research, and is not intended to be comprehensive. Information should be given through a variety of routes and in the context of other information provided by the organisation about its activities. It is for data controllers to determine what other transparency information they should provide and the means of providing it.

Separate text has been published by HRA on behalf of the NHS, describing the use of personal data by NHS sites in their role as 1) data controllers for clinical and health care purposes, providing previously collected personal data to sponsors for research purposes, and 2) data processors on behalf of sponsors for directly collected personal data for research. NHS organisations should signpost this information to ensure patients can find consistent transparency information. Where NHS organisations are acting as sponsors, the text provided below should be provided in addition to signposting text published by the HRA.

Where equivalent information has already been provided, there is no need to alter it to the wording below. You are advised to document your decisions about:

  • what information has previously been provided eg in participant information sheets
  • what additional information you need to provide
  • how you will provide it (at study-specific or other levels)

Where information is provided in separate documents or leaflets rather than as part of participant information sheets, they should use the sponsor’s name and logo and include the study title and IRAS ID at the top.

Recommended transparency wording

You should include the text in the first box in all cases, and then select text from the sections marked A, B and C as appropriate and within these, select the options in italics as relevant. Replace text in square brackets [ ] as appropriate.

In PIS or document provided to participants

[Sponsor organisation] is the sponsor for this study based in [the United Kingdom/ country]. We will be using information from [you and/or your medical records] in order to undertake this study and will act as the data controller for this study. This means that we are responsible for looking after your information and using it properly. [Sponsor organisation] will keep identifiable information about you [for x years after the study has finished/ until x].

Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

You can find out more about how we use your information [at URL and/or by contacting XXX].

In information published by sponsor unit/department/organisation

As a [university/ NHS organisation] we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research.  This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

Our Data Protection Officer is [name] and you can contact them at [email].

A: Where participants are providing personal data directly ie personal data is obtained for the primary purpose of research either verbally or in writing from participants eg questionnaires or interviews, or documented by care staff eg diagnosis, or obtained from care interventions eg lab results

In PIS or document provided to participants

[NHS/other site] will collect information from [you and/or your medical records] for this research study in accordance with our instructions.

EITHER:

1 [If a code system is used and the key is kept confidential and not disclosed to the sponsor, except where the sponsor is also the site]

[NHS/other site] will keep your name, [NHS number] and contact details [add other identifiers] confidential and will not pass this information to [sponsor organisation]. [NHS/other site] will use this information as needed, to contact you about the research study, and make sure that relevant information about the study is recorded for your care, and to oversee the quality of the study. Certain individuals from [sponsor organisation] and regulatory organisations may look at your medical and research records to check the accuracy of the research study. [Sponsor organisation] will only receive information without any identifying information. The people who analyse the information will not be able to identify you and will not be able to find out your name, [NHS number] or contact details.

[NHS/ other site] will keep identifiable information about you from this study [for x years after the study has finished/ until x].

OR

2 [If the sponsor will receive personal data, or where the sponsor is also the site]

[NHS/other site] will use your name, [NHS number] and contact details [add other identifiers] to contact you about the research study, and make sure that relevant information about the study is recorded for your care, and to oversee the quality of the study. Individuals from [sponsor organisation] and regulatory organisations may look at your medical and research records to check the accuracy of the research study. [NHS site] will pass these details to [Sponsor organisation] along with the information collected from [you and/or your medical records]. The only people in [sponsor organisation] who will have access to information that identifies you will be people who need to contact you to [insert reason]or audit the data collection process. The people who analyse the information will not be able to identify you and will not be able to find out your name, [NHS number] or contact details.

[NHS/ other site] will keep identifiable information about you from this study [for x years after the study has finished/ until x]. 

B: Where participants are providing information indirectly eg being obtained from previously collected medical records or database

In information published by sponsor unit/department/organisation, where the source has means to contact the participant within a period of one month from the provision of the information, include in PIS or document provided to participants

EITHER

1 [If a code system is used and the key is kept confidential and not disclosed to the sponsor]

[Sponsor organisation] will collect information about you for [research/ this research study] from [source]. [Source] will not provide any identifying information about you to [sponsor organisation]. We will use this information to [purpose].

OR

2 [If the sponsor will receive personal data]

 [Sponsor organisation] will collect information about you for [research/ this research study] from [source]. This information will include [your name/ NHS number/ contact details/ add other identifiers] and health information, which is regarded as a special category of information. We will use this information to [purpose]. 

C. Where data is intended to or likely to be used for future research

In information published by sponsor unit/department/organisation

When you agree to take part in a research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations. These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.

EITHER:

This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose of health and care research, and cannot be used to contact you or to affect your care. It will not be used to make decisions about future services available to you, such as insurance.

OR:

Your information could be used for research in any aspect of health or care, and could be combined with information about you from other sources held by researchers, the NHS or government. 

Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of health and care research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you, such as insurance.

Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.

Back to templates