How do I ensure UK GDPR compliance in trials? Identify an Article 6 lawful basis of public task or legitimate interests, pair it with the Article 9(2)(j) research condition and the Data Protection Act 2018 safeguards, then configure every system holding the data to enforce minimisation, pseudonymisation, role-based access and retention.
Two questions sit behind most information governance reviews at a UK site: how do I ensure UK GDPR compliance in trials, and how do trial platforms handle UK GDPR requirements. The first is settled by law. The second is settled by configuration, and a site answers it at procurement rather than at the end of a study.
This guide covers the legal chain a UK site has to evidence, the controller and processor split, transparency and retention, what a platform has to do, where trial data may be hosted, and what the Data (Use and Access) Act 2025 changes. It is written for research teams and is not legal advice.
The law sets the duty. The system settings are the evidence.
How Do I Ensure UK GDPR Compliance in Trials?
Compliance rests on six layers, each from a different instrument. A site holding only the sponsor’s data protection annex has covered one of them.
| The legal layer | Where it comes from | What satisfies it at a UK site |
| An Article 6 lawful basis | UK GDPR Article 6 | A task in the public interest for an NHS organisation or university, and legitimate interests for a commercial or charitable sponsor |
| An Article 9 condition for health data | UK GDPR Article 9(2)(j) | Processing necessary for scientific or historical research purposes, or for statistical purposes |
| The research safeguards | Data Protection Act 2018, Schedule 1, paragraph 4 | Processing that is proportionate, in the public interest, unlikely to cause substantial damage or distress, and not used for decisions about particular people |
| Technical and organisational measures | UK GDPR Article 89(1) | Minimisation, early pseudonymisation, access control, security and an impact assessment where one is needed |
| Release from confidentiality | The common law duty of confidentiality | Participant consent, or section 251 support in England and Wales |
| Transparency | UK GDPR Articles 13 and 14 | Participant privacy information, plus corporate information on how the organisation uses research data |
The ICO research provisions guidance states that research has no lawful basis of its own, and that for research-related processing “it is unlikely that consent is the correct lawful basis”. Public task applies to public authorities such as universities and NHS organisations. Legitimate interests applies to private and third sector organisations.
Consent still does work in a trial, in two other places. The HRA guidance on consent in research, last updated 19 April 2018, states that the legal basis for health and social care research should not be consent, and that consent is still needed for people outside the care team to access confidential patient information. Our guide to how NHS sites give monitors EPR access without breaching UK GDPR works through that distinction permission by permission.
The fourth layer is the one a site evidences least often. The ICO guidance on appropriate safeguards describes the Article 89(1) safeguards as technical and organisational measures, naming pseudonymisation and data minimisation among them. Those are system settings rather than contract clauses.
Who Holds Controller and Processor Duties at a UK Site?
Roles divide by who decides the purpose. HRA guidance states that the sponsor of the research is the data controller. The NHS organisation keeps its own controller duties for the care record it holds, so one set of information can carry two controllers for two purposes.
- The sponsor decides the research purpose and the dataset, which makes it controller for the research data.
- The NHS organisation decides how the care record is held and disclosed, which keeps its controller duties intact whatever the trial agreement says.
- A software supplier acts on documented instructions and decides nothing about purpose, which makes it a processor under an Article 28 contract.
- A sub-processor inherits the same instructions, so the supplier needs authorisation before adding one.
The split decides who answers a participant. A request about research data goes to the sponsor, and one about the care record goes to the trust. A platform that cannot separate the two datasets turns both into a manual search.
Also Read: How Do NHS Sites Give Monitors EPR Access Without Breaching UK GDPR?
What Must a Site Evidence on Transparency, Minimisation and Retention?
Four duties produce documents a site can be asked for on the day.
- Transparency. HRA detailed guidance asks organisations to review the project-specific information given to participants alongside the corporate information about research data sharing, which means the participant information sheet and the organisation’s research privacy notice have to agree.
- Minimisation and pseudonymisation. The ICO advises considering whether anonymised data would meet the research aims first, because anonymous information falls outside data protection law, and states that pseudonymous data is still personal data, to be pseudonymised as early as possible and ideally before research use.
- A data protection impact assessment where the processing is likely to result in a high risk, which for a trial usually means one assessment by the sponsor and one by the organisation hosting the system.
- Retention. Storage limitation sets the ceiling and the trial retention duty sets the floor, so the schedule satisfies both rather than following the software licence term.
The two assessments and the retention position are worked through in our guide to eISF requirements for NHS trusts.
How Do Trial Platforms Handle UK GDPR Requirements?
A platform handles UK GDPR requirements through six configurable controls, and each one discharges a named provision. Published comparisons answer this question for a sponsor or a CRO choosing a global system. A UK site asks something narrower: which of these controls can the site itself see, set and evidence.
- UK data residency. The platform states where the data sits, which decides whether the Article 44 transfer rules apply at all.
- Pseudonymisation at the point of entry. The system separates identifiers from trial data as the record is created, which satisfies the Article 89(1) safeguard rather than deferring it.
- Role-based access scoped to the study. A user reaches only the participants and documents their role covers, which is how minimisation is enforced instead of asserted.
- An audit trail that records reads. The log shows who opened a record and when, which answers a governance review about access rather than about permissions.
- Retention and deletion as a setting. The schedule is held in the system with a deletion mechanism behind it, which keeps storage limitation provable on any date.
- Published assurance. NHS procurement verifies the Data Security and Protection Toolkit, Cyber Essentials and the Digital Technology Assessment Criteria, which a trust checks before go-live.
Role-based access is the control that drifts first. In AQ, access follows the delegation log, so a person’s permissions change on the date their delegation changes rather than when someone remembers to amend an account. The assurance stack is covered in full in our guide to what NHS procurement expects of research software.
What Should a Site Ask a Platform Supplier?
Eight questions turn those controls into evidence a procurement file can hold.
| What to ask | Why it matters | Evidence to request |
| Where is the data hosted? | Hosting location decides whether a restricted transfer arises | A named hosting region and a list of sub-processors with locations |
| Is the data pseudonymised, and at what point? | Article 89(1) names pseudonymisation among the safeguards | A data flow diagram showing where identifiers are separated |
| How does access control map to the study? | Minimisation depends on a user reaching only their own participants | Role definitions and a demonstration of role scoping on a test study |
| Does the audit trail record reads as well as writes? | A site has to show who read a record as well as who changed one | A sample audit trail export covering a read event |
| What is the retention and deletion position? | Storage limitation applies alongside the trial retention duty | A written retention schedule and the deletion mechanism behind it |
| What assurance does the supplier hold, and when does it renew? | NHS procurement verifies DSPT, Cyber Essentials and DTAC | The current DSPT publication, Cyber Essentials certificate and a completed DTAC |
| How are sub-processor changes notified? | A processor needs authorisation before adding a sub-processor | The sub-processor list and the contractual notice period |
| What happens to the data on exit? | Retention duties outlive the contract term | An export format and a documented exit process |
Also Read: DSPT and Cyber Essentials: What NHS Procurement Expects of Research Software
Where Must Trial Data Be Hosted, and When Is a Transfer Restricted?
UK GDPR sets no rule that trial data must be hosted in the UK. It sets a rule about what happens when the data leaves. The ICO guide to international transfers applies a three-step test, and transfer covers both sending personal information and making it accessible.
- UK GDPR applies to the processing of the information being transferred.
- The organisation is initiating the transfer to an organisation outside the UK.
- The receiving organisation is a separate legal entity.
Three answers of yes make it a restricted transfer, and the rules then cover even small and infrequent transfers. One of three mechanisms has to carry it: UK adequacy regulations, an Article 46 safeguard such as the International Data Transfer Agreement or the Addendum together with a transfer risk assessment, or an Article 49 exception. The ICO states that an organisation unable to identify an appropriate exception must not make the transfer.
Remote access counts. A monitor reading a UK-hosted record from outside the UK is a transfer under this test, which is why an access agreement names permitted locations. UK hosting settles the question for the platform and leaves it live for everyone who logs in.
What Does the Data (Use and Access) Act 2025 Change for Research?
The ICO summary of the Data (Use and Access) Act 2025, published 19 June 2025 and last updated 20 August 2025, describes changes that reach research directly. The ICO also records that its own research provisions guidance is under review because of the Act and may change.
- A definition of scientific research enters the UK GDPR, covering commercial research, technological development, fundamental or applied research, and public health research conducted in the public interest.
- Broad consent is permitted for scientific research where the exact purpose cannot be identified when consent is obtained, seeking it is consistent with relevant ethical standards, and people can consent to only part of the research.
- Purpose limitation is clarified. Data collected under a lawful basis other than consent may be used for a new research purpose where the relevant safeguards are followed, and a lawful basis is still needed.
None of this moves the lawful basis for a trial. The Act widens what counts as research and tidies how consent and re-use work around it.
Where Does UK GDPR Compliance Break Down at UK Sites?
Six failures account for most findings, and each is a condition set before anyone looked.
| Failure | What it looks like | Condition behind it |
| Consent recorded as the lawful basis | The data protection section of the protocol names consent | The template predates the HRA position and nobody revisited it |
| One account shared across the research team | Reads attribute to a team rather than to a person | Provisioning treated the delivery team as a single user |
| Access that outlives the delegation | A coordinator reaches participants months after leaving the study | Account review was never attached to the delegation log |
| A sub-processor added without notice | Data becomes accessible from a region nobody assessed | The contract set no notification requirement |
| Transparency wording that names one controller | The information sheet names the sponsor and omits the trust | The site’s own controller duties were never written down |
| Retention set to the contract term | Records are deleted before the retention duty expires | The schedule followed the software licence rather than the regulations |
Consider a hypothetical oncology study at an NHS trust. A quarterly account review finds a research nurse still holding read access seven months after her delegation ended, and the log shows eleven reads in that period, all against consented participants. The finding is the provisioning process rather than the nurse’s conduct, because nothing connected her account to the delegation log. The corrective action moves account closure onto the delegation record, where the end date already existed.
An access nobody withdrew is a disclosure nobody authorised.
Also Read: eISF for NHS Trusts: Electronic Investigator Site File Requirements
The UK GDPR Controls AQ Holds on One Record
AQ Platform is UK-hosted, and the controls a site has to evidence sit on the same study record as the work itself. The point of connecting them is that the evidence is a read of the record rather than a reconstruction.
- Access follows delegation. AQ Digital DoA holds who is authorised to do what from which date, and the same record decides what each person can reach, closing the gap between a delegation ending and an account being withdrawn.
- One audit trail across the modules. AQ eISF, AQ CTMS, AQ Pharmacy and AQ QMS write to one connected record, so a question about who reached a document has one answer.
- Published NHS assurance. AQ holds NHS Data Security and Protection Toolkit Standards Met (2026), is Cyber Essentials certified, and operates ISO 27001-aligned controls, which is the evidence a trust asks for before go-live.
- Validation with every release. AQ is validated to GxP standards with each release, covering installation, operational and performance qualification and a 21 CFR Part 11 and EU Annex 11 assessment, which supports MHRA compliance and is built for MHRA GCP inspection.
- Proven at scale in the NHS. Six years of continuous daily NHS use, 13 sites on one connected record and more than 150 studies, at organisations including University Hospitals of Liverpool Group and Royal Free London.
AQ was built by Phase 1 trial doctors, which is why these controls are settings a research team owns rather than assurances a supplier offers. Book a live demo to see the AQ platform today.
Frequently Asked Questions
How do I ensure UK GDPR compliance in trials?
Identify an Article 6 lawful basis of public task or legitimate interests, pair it with the Article 9(2)(j) research condition and the Data Protection Act 2018 safeguards, and satisfy the common law duty of confidentiality separately. Then configure the systems holding the data to enforce minimisation, pseudonymisation, role-based access and retention. The proof is the privacy information, the impact assessment, the processor contract and the access records.
How do trial platforms handle UK GDPR requirements?
Through six configurable controls: data residency, pseudonymisation at the point of entry, role-based access scoped to the study, an audit trail that records reads, retention and deletion held as a setting, and published assurance NHS procurement can verify. A site should ask to see each one demonstrated on a test study.
Is consent the lawful basis for research data?
No. The ICO states that for research-related processing it is unlikely that consent is the correct lawful basis, because UK GDPR consent can be withdrawn at any time and no research exemption to that exists. HRA guidance states the same position for health and social care research. Consent to take part in a study remains a separate ethical and legal requirement.
Who is the data controller in a clinical trial?
HRA guidance states that the sponsor of the research is the data controller. The NHS organisation keeps its own controller duties for the care record it holds, so one set of information can carry two controllers for two purposes. A software supplier acting on documented instructions is a processor, which calls for an Article 28 contract.
Does a site need its own DPIA?
A data protection impact assessment is required where processing is likely to result in a high risk to people’s rights and freedoms. In practice a trial often produces two: one covering the research processing, held by the sponsor, and one covering the system, held by the organisation that operates it.
Where must trial data be hosted?
UK GDPR sets no requirement to host trial data in the UK. It restricts transfers out of the UK, and the restriction catches both sending data and making it accessible from abroad. A transfer needs UK adequacy regulations, an Article 46 safeguard with a transfer risk assessment, or an Article 49 exception.
Does the Data (Use and Access) Act 2025 change the lawful basis for a trial?
No. The ICO describes the Act as adding a definition of scientific research, permitting broad consent where the exact purpose cannot yet be identified, and clarifying when data collected under another basis may be re-used for research. The Article 6 and Article 9 analysis for a trial is unchanged.
