{"entity":{"id":"uk-data-protection-act","kind":"term","name":"UK Data Protection Act 2018 and health data law","aka":["Data Protection Act 2018","UK GDPR","Data (Use and Access) Act 2025","national data opt-out","section 251","Confidentiality Advisory Group","common law duty of confidentiality","Caldicott principles"],"tldr":"The UK's data law, which keeps the EU's GDPR in domestic form and adds NHS-specific rules, so that cancer registries and research can use patient records under a public-interest basis, patients can opt out of secondary uses, and a 2025 Act loosened the consent rules for scientific research.","summary":"United Kingdom, statutes. The Data Protection Act 2018 implemented the GDPR in UK law and, after Brexit, the retained 'UK GDPR' and the Act together form the framework, amended by the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. Health data are also protected by the common law duty of confidentiality, with the Health Service (Control of Patient Information) Regulations 2002 (made under what is now section 251 of the NHS Act 2006) allowing the Confidentiality Advisory Group to approve use of identifiable data without consent for research and public health, the legal basis on which the National Disease Registration Service collects every cancer diagnosis in England. Primary text: legislation.gov.uk.\n\nWhat it means in practice: the national data opt-out (2018) lets patients block use of their confidential information for research and planning beyond their direct care; NHS England's secure data environments now provide access to linked records for approved research; and the 2025 Act redefined scientific research to include commercial research, allowed broad consent to an area of research, recognised 'legitimate interests' for some processing, and reformed the information commissioner into a board. A voluntary code between the government and the Association of British Insurers restricts insurers' use of predictive genetic tests, with a disclosure ceiling that has applied only to Huntington's disease.\n\nThe arguments: the care.data programme collapsed in 2016 over trust, and the GP data extraction of 2021 was paused after millions opted out; researchers argue that the opt-out biases registries and that England's system is more permissive on paper than in practice; privacy groups fought the 2025 Act's research provisions. For oncology the registry, linked to treatment and genomic data through the Genomics England 100,000 Genomes Project, is among the richest population datasets in the world.","asOf":"2026-09-17","wikipedia":"https://en.wikipedia.org/wiki/Data_Protection_Act_2018","links":[{"label":"Wikipedia","url":"https://en.wikipedia.org/wiki/Data_Protection_Act_2018"},{"label":"legislation.gov.uk: Data Protection Act 2018","url":"https://www.legislation.gov.uk/ukpga/2018/12"},{"label":"legislation.gov.uk: Data (Use and Access) Act 2025","url":"https://www.legislation.gov.uk/ukpga/2025/18"}],"tags":["law","uk"],"related":["gdpr","hipaa","european-health-data-space","gina","medicines-medical-devices-act-2021","oncology-real-world-data","germline-testing","pipl"],"cancers":[],"sections":[],"technologies":[],"targets":[],"drugs":[],"companies":[],"institutions":["mhra"],"pathways":[],"terms":[],"trials":[],"people":[],"bottlenecks":["b-data-silos","b-real-world-evidence"],"keyPapers":[],"journals":[],"dependsOn":[],"notes":[],"category":"Regulation & policy"},"route":"/terms/uk-data-protection-act/","neighbours":{"term":[{"id":"european-health-data-space","kind":"term","name":"European Health Data Space Regulation (EU) 2025/327","route":"/terms/european-health-data-space/"},{"id":"gdpr","kind":"term","name":"GDPR and health data (Regulation (EU) 2016/679)","route":"/terms/gdpr/"},{"id":"gina","kind":"term","name":"GINA (Genetic Information Nondiscrimination Act 2008)","route":"/terms/gina/"},{"id":"hipaa","kind":"term","name":"HIPAA (Health Insurance Portability and Accountability Act)","route":"/terms/hipaa/"},{"id":"medicines-medical-devices-act-2021","kind":"term","name":"Medicines and Medical Devices Act 2021","route":"/terms/medicines-medical-devices-act-2021/"},{"id":"pipl","kind":"term","name":"PIPL (China Personal Information Protection Law 2021)","route":"/terms/pipl/"}],"technology":[{"id":"germline-testing","kind":"technology","name":"Germline (hereditary) testing","route":"/technologies/germline-testing/"},{"id":"oncology-real-world-data","kind":"technology","name":"Oncology EHR and real-world data platforms","route":"/technologies/oncology-real-world-data/"}],"institution":[{"id":"mhra","kind":"institution","name":"Medicines and Healthcare products Regulatory Agency","route":"/institutions/mhra/"}],"bottleneck":[{"id":"b-data-silos","kind":"bottleneck","name":"Data silos","route":"/bottlenecks/b-data-silos/"},{"id":"b-real-world-evidence","kind":"bottleneck","name":"Weak real-world evidence and registries","route":"/bottlenecks/b-real-world-evidence/"}]}}