Data Use Act 2025 | Key Changes for Scientific Research

On June 19, 2025, the Data (Use and Access) Bill[*] received Royal Assent and became law (the Act). This Act introduces significant reforms to the UK’s data protection framework, with specific relevance for research organisations that process personal data. Below, we summarise the Act’s most relevant changes for scientific research and explain what each one means in practice for research organisations.

🔹 A statutory definition of scientific research (section 67)

What is new? The Act broadens the definition of scientific research, which includes “any research that can reasonably be described as scientific, whether publicly or privately funded, and whether carried out as a commercial or non-commercial activity.”

What does it mean for organisations in the Life Science and MedTech sectors? The new definition extends the range of research activities that can benefit from research-specific data processing provisions, making it easier for both commercial and academic research organisations to justify their use of personal data.

🔹 Consent to processing for the purposes of scientific research (section 68)

What is new? The Act recognises that a consent for the processing of personal data for scientific research purposes is valid even if specific purposes of data processing cannot be fully identified at the time the consent is obtained, provided that ethical standards are followed and, where possible, data subjects can give consent for parts of the research. Such broad consent is deemed equivalent to specific consent for UK GDPR purposes. These changes do not erode the requirement for a lawful basis under Article 6 or for an exemption on the prohibition of processing special category data (e.g., health data) under Article 9.

What does it mean for the Life Science and MedTech sectors? This is likely to be of particular value in the Life Sciences sector, a pharmaceutical company engaged in oncology research might establish a biobank of tumour samples and associated genetic data from patients. Under the DUAA’s provisions for broad consent, the sponsor could obtain participant agreement for processing personal data within the general domain of “cancer therapeutics development” without delineating every prospective analytical technique or hypothesis at the outset - such as future applications of CRISPR editing or AI-driven treatment predictions that emerge post-collection.

🔹 Re-use of personal data for research (sections 71 and 77)

What is new? The Act introduces a more flexible approach to the purpose limitation principle, particularly benefiting organisations that do not rely on consent as the original lawful basis. When data is collected on grounds other than consent, there is now a presumption that secondary use for research purposes will be compatible with the original collection purpose, provided the relevant safeguards are met. However, if consent was the original basis, new consent will generally be required for secondary research use, unless a specific exception applies.

The Act also allows controllers to forgo issuing new privacy notices for the reuse of personal data for further research if providing such notice would involve disproportionate effort, as long as the information is made publicly available.

What does it mean for the Life Science and MedTech sectors? If future research use is anticipated, organisations should:

Consider lawful bases other than consent when collecting data to allow greater flexibility for secondary use.
Implement appropriate safeguards (ensuring data minimisation, preventing harm or distress to individuals, and avoiding decision-making about individuals unless it’s approved medical research).

When reusing personal data for further research, organisations should assess whether issuing new privacy notices would involve disproportionate effort. Where this is the case, organisations can meet their transparency obligations by making relevant information (the research purpose, lawful bases, safeguards, and individuals’ rights) publicly available on their website.

A sponsor specializing in rare fungal infections may have conducted a Phase II clinical trial in the UK to evaluate an investigational product, relying on legitimate interests as the lawful basis for processing participant health data. Under the DUAA’s amendments to purpose limitation in Article 5(1)(b) and the insertion of Article 8A, this sponsor could repurpose pseudonymized trial datasets for secondary genomic sequencing analyses aimed at identifying resistance mutations, presuming compatibility with the original purpose provided Article 89(1) safeguards are applied.

As not originally reliant upon consent, the sponsor can avoid undergoing the compatibility test or reconsenting of the participants enabling integration of the data into research activities without procedural delays. Additionally, if reissuing privacy notices to trial participants proves disproportionately effortful due to cohort dispersal and data age, the sponsor may forgo individual notifications under the revised Articles 13 and 14, opting instead for public dissemination of updated processing details through clinical registries.

🔹 Safeguards for processing for research purposes (section 86)

What is new? Processing of personal data for research purposes must be subject to appropriate safeguards:

processing is not causing damage or distress to data subjects;
processing is not for decisions/measures about a specific data subject, except for approved medical research (research approved by recognised ethics committees or relevant NHS/research bodies);
safeguards must include technical and organisational measures to ensure data minimisation.

What does it mean for the Life Science and MedTech sectors? In practice, there is nothing particularly impactful, the new stipulations introduce explicit criteria to operationalise these protections, ensuring that research processing aligns with proportionality and risk mitigation principles. Therefore, sponsors must:

Conduct DPIAs to assess the risk of harm or distress to data subjects before beginning any new research project.
Collect and process only the data strictly necessary for research purposes.
Use technical safeguards, such as pseudonymisation and secure storage.
Implement organisational measures such as access controls, staff training and data governance procedures.
Document safeguards and decisions to demonstrate compliance.

Regarding the inclusion of “distress” and its relation to Data Protection Impact Assessments (DPIAs): This term is newly codified within the research-specific safeguards of Section 86, representing a statutory clarification absent from the original Article 89(1), which referenced safeguards for “rights and freedoms” in general terms. DPIAs have long required evaluation of risks to rights and freedoms, with Recital 75 giving guidance that other non-material aspects should be considered (e.g., discrimination, identity theft, or reputational harm), this may have previously been interpreted to encompass distress or emotional impact, particularly in high-risk processing involving health or genetic data, however now there is an obligation to include such consideration in the DPIAs for the research activities in the United Kingdom.

Commencement (section 142)

The above research-related provisions will come into force gradually, depending on when the Secretary of State issues specific regulations.

✅ Conclusion

The Act introduces changes that clarify the lawful use of personal data for research in the UK. For research organisations, the Act presents new opportunities to use data more flexibly, especially in long-term or adaptive studies, while clarifying the need for documented safeguards.

To take full advantage of these reforms, Sponsors and research organisations should contact MyData-TRUST to ensure their data collection practices, lawful bases, and internal safeguards align with what is allowed to make full use of the data which has been collected.

[*] Data (Use and Access) Act 2025, available at https://www.legislation.gov.uk/ukpga/2025/18/enacted

Elmira MAMEDOVA & Edward SHEEHAN