UK Data Protection Act 2018 and health data law

United Kingdom, statutes. The Data Protection Act 2018 implemented the GDPR in UK law and, after Brexit, the retained 'UK GDPR' and the Act together form the framework, amended by the Data (Use and Access) Act 2025, which received Royal Assent on 19 June 2025. Health data are also protected by the common law duty of confidentiality, with the Health Service (Control of Patient Information) Regulations 2002 (made under what is now section 251 of the NHS Act 2006) allowing the Confidentiality Advisory Group to approve use of identifiable data without consent for research and public health, the legal basis on which the National Disease Registration Service collects every cancer diagnosis in England. Primary text: legislation.gov.uk.

What it means in practice: the national data opt-out (2018) lets patients block use of their confidential information for research and planning beyond their direct care; NHS England's secure data environments now provide access to linked records for approved research; and the 2025 Act redefined scientific research to include commercial research, allowed broad consent to an area of research, recognised 'legitimate interests' for some processing, and reformed the information commissioner into a board. A voluntary code between the government and the Association of British Insurers restricts insurers' use of predictive genetic tests, with a disclosure ceiling that has applied only to Huntington's disease.

The arguments: the care.data programme collapsed in 2016 over trust, and the GP data extraction of 2021 was paused after millions opted out; researchers argue that the opt-out biases registries and that England's system is more permissive on paper than in practice; privacy groups fought the 2025 Act's research provisions. For oncology the registry, linked to treatment and genomic data through the Genomics England 100,000 Genomes Project, is among the richest population datasets in the world.