Legal and ethical obligations in research

Collecting, using and sharing data in research with people requires that ethical and legal obligations are respected.

Laws such as the Data Protection Act, Freedom of Information Act and Statistics and Registration Services Act can govern the use and sharing of data containing personal, sensitive or confidential information. See the tabs below for details.

In research with people, there may be a perceived tension between data sharing on one hand and data protection on the other. If you are a researcher or work with a Research Ethics Committee (REC), consult our guidance for RECs on how research data can be shared without breaching ethical or legal responsibilities.


Duty of confidentiality
Statistics Act 2007
Data protection
Ethical obligations
Research ethics approval
Freedom of information
Human rights
Guidance for RECs

In research with people there may be a perceived tension between data sharing and data protection. Research Ethics Committees (RECs) can play a role in advising researchers how their data can be shared while upholding data data protection and research ethics' principles.

Role of Research Ethics Committeess

The role of RECs is to protect the safety, rights and well-being of research participants and to promote ethically sound research. Among other duties, this involves ensuring that research complies with the Data Protection Act 1998 regarding the use of personal information collected in research. At the same time, RECs need to be aware of conditions placed upon research grants to share data outputs.

RECs can play a mediating role in reconciling data sharing and data protection by advising researchers that:

  • many funders recommend or require data sharing or data management planning
  • most research data obtained from participants can be successfully shared without breaching confidentiality
  • data protection laws only apply to personal data where consent has not been given to disclose, but they do not apply to anonymised data
  • identifiable information may be excluded from data sharing
  • even personal sensitive data can be shared if suitable procedures and precautions are taken, as is done at major data centres
  • a combination of gaining consent for data sharing, anonymising data and controlling access to data can enable the ethical and legal sharing of data.

Ideally, participants should have an opportunity to make an informed decision about whether or not their data can be shared. Survey and qualitative data held at the UK Data Service are typically anonymised, unless specific consent has been given for personal information to be included. They are not in the public domain and their use is regulated for specific purposes after user registration. Users sign an End User Licence in which they agree to conditions such as not attempting to identify any individuals from the data and not sharing data with unregistered users. For confidential or sensitive data, stricter access controls may be imposed.

RECs can play a critical role by providing information to researchers at the consent and planning stages on how to share data ethically. An increasing number of university RECs are addressing data sharing in their guidelines or in ethical review procedures.

Back to top