This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies.

Find out more here.

GDPR Guidance >   What the law says >

The GDPR incorporates a range of exemptions from data subject rights for health research, to take account of particular aspects of research. These exemptions need to be balanced with what is fair to participants. What do they understand about withdrawal from the research project? Has the research significantly evolved from what they understand? What were they told about further uses?

 The following data subject rights may be limited:

  • The right to erasure
  • The right to access by the data subject
  •  The right to rectification
  • The right to restrict processing
  • The right to object to processing
The following data subject right is not applicable to research under legitimate interests or public interest:

  • The right to data portability

Where any participant seeks to use one of the above rights, you should seek advice from your Data Protection Officer. This does not prohibit corrections to data or other operational arrangements such as updating contact details, or permitting a participant to withdraw from a study. You should be clear what withdrawal looks like with respect to data, e.g. no further collection of data but retention of data already collected; retention of data and use in this project but no use in future research, etc.

In general these exemptions are similar to those under previous legislation, and mean that normally there will be no right for research participants to access their data, rectify it or have their data erased.

It is likely that under national policy patients in England will be able to opt out of use of their confidential patient information for research.

The implementation of appropriate safeguards permits these research exemptions in relation to data subject rights to be used.

Back to what the law says