Data Protection Regulation
The European General Data Protection Regulation (GDPR) was agreed in April 2016 and took effect from 25 May 2018.
The UK implemented a new Data Protection Act at the same time that complemented the regulation.
On this page
Personal data – such as information collected by a doctor or hospital, or as part of a research study – is a vital resource for research that has the potential to improve and save lives.
The regulation creates a supportive framework for scientific research, including safeguards to ensure personal information is used appropriately and remains secure.
During negotiations, the European Parliament proposed amendments to the regulation that would have imposed disproportionate limits on the use of health data. These would have had a devastating impact on research. We’re delighted that the regulation rejected these amendments.
What we’re doing
The regulation leaves it up to European Union member states to put detailed rules in place to govern the use of personal data in research.
The Data Protection Act went through UK Parliament to set out these rules for the UK. We worked with the research community and policy makers to ensure a strong outcome for research.
The Act creates a complete legal framework for data protection after the UK has left the EU. It is important for data to continue to flow across borders for research purposes and we support close alignment between the regulation and UK law following Brexit.
We also worked with the Health Research Authority and other key organisations to develop guidance on the General Data Protection Regulation for health researchers.
Timeline of key dates
Our timeline sets out the key dates for the agreement and implementation of the new regulation.
- The regulation takes effect in all European Union member states on 25 May 2018.
- The UK implements the Data Protection Act 2018 at the same time.
- Working closely with peers and the Department for Culture, Media and Sport, we successfully advocate for the government to introduce amendments to the Bill to ensure there is a clear legal basis for clinical trials to process data.
- The Health Research Authority produces guidance for researchers on how to ensure they are complying with the regulation.
- We provide briefings to the House of Lords on the Data Protection Bill, setting out areas of concern for research. See our briefings for the second reading [PDF 84KB] and committee stage [PDF 216KB] of the Bill.
- The UK government publishes a Data Protection Bill, which sets out how the exemptions permitted by the regulation will be implemented in the UK.
- Beth Thompson, Wellcome's Head of Policy – UK and EU, is awarded an MBE for her work on the regulation.
- The Department of Culture, Media and Sport asks for views on the exemptions allowed by the regulation. We make the case for the importance of exemptions for research [PDF 204KB] and 21 UK organisations sign our response.
We respond to the Information Commissioner’s Office draft guidance on consent [PDF 177KB], which explains what counts as valid consent in the regulation. The guidance also outlines the alternatives to seeking consent.
- We set out how we think the regulation should be implemented by the UK government [PDF 506KB] and European member states.
- The regulation becomes law and must be implemented in two years. See our analysis of the key clauses [PDF 297KB].
- The European Parliament and Council of Ministers formally agree the final text of the regulation.
- A compromise text is finalised and receives the support of the European Parliament and member states in informal votes. The regulation rejects damaging amendments proposed by the European Parliament.
- The European Parliament, Council of Ministers and European Commission begin trilogue negotiations.
- We ask the Council of Ministers, European Parliament and European Commission to work together to find a compromise position that maintains important exemptions for research while including proportionate safeguards.
- We publish a joint statement from patient, academic and non-commercial research organisations summarising our position [PDF 635KB] and a detailed analysis with preferred solutions [PDF 133KB].
- The Council of Ministers agrees its general approach on the regulation. The Council’s position on research is broadly positive.
- The European Parliament adopts amendments to Articles 81 and 83 that would severely restrict the use of personal data for scientific research purposes without specific consent. It is vital that amendments to Articles 81 and 83 are opposed in negotiations on the regulation.
- We send an open letter to The Times highlighting research concerns ahead of the European Parliament vote on the Data Protection Regulation.
- We issue a briefing from a round table workshop in the European Parliament: Keeping health research alive in the EU [PDF 436KB].
- With other research organisations, we issue a joint statement on the European Parliament’s position [PDF 349KB].
- Together with the Federation of the European Academies of Medicine, we issue a detailed briefing setting out concerns about the rapporteur’s amendments [PDF 306KB].
- The European Parliament rapporteur publishes a draft report on the regulation. The draft report includes amendments that, if implemented, would have a devastating impact by imposing disproportionate limits on the use of health data in research.
- We respond to the House of Commons Justice Committee inquiry on the EU Data Protection Framework Proposals [PDF 75KB].
- We respond to the Ministry of Justice’s call for evidence on EU Data Protection Proposals [PDF 92KB].
- The European Commission publishes a draft Data Protection Regulation with a view to replacing the existing Data Protection Directive and associated Member State legislation.
- Find out more about our work on using patient data in research
- Between 2014 and 2015 we were part of the European Data in Health Research Alliance, which brought together academic, patient and research organisations committed to ensuring that the Data Protection Regulation allows vital health research to continue.
If you have any questions, contact Beth Thompson
Sharing data helps researchers to access and build on new information and knowledge.
The European Union supports science through legislation, funding opportunities and programmes to help cross-border collaboration.
Science policy affects a broad range of issues, ranging from data sharing and gene editing, to intellectual property and regulation.
Regulation creates an environment where research and innovation can flourish.