Legislation – Data (Use and Access) Act 2025
Which version?
Latest available (Revised)
Original (As enacted)
Changes to legislation:
There are currently no known outstanding effects for the Data (Use and Access) Act 2025, Cross Heading: Definitions in the UK GDPR and the 2018 Act.
Changes to Legislation
Revised legislation carried on this site may not be fully up to date. At the current time any known changes or effects made by subsequent legislation have been applied to the text of the legislation you are viewing by the editorial team. Please see ‘Frequently Asked Questions’ for details regarding the timescales for which new effects are identified and recorded on this site.
Part 5Data protection and privacy
Chapter 1Data protection
Definitions in the UK GDPR and the 2018 Act
67Meaning of research and statistical purposes
(1)
In Article 4 of the UK GDPR (definitions)—
(a)
the existing text becomes paragraph 1, and
(b)
“2.
References in this Regulation to the processing of personal data for the purposes of scientific research (including references to processing for “scientific research purposes”) are references to processing for the purposes of any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity.
3.
Such references—
(a)
include processing for the purposes of technological development or demonstration, fundamental research or applied research, so far as those activities can reasonably be described as scientific, but
(b)
only include processing for the purposes of a study in the area of public health that can reasonably be described as scientific where the study is conducted in the public interest.
4.
References in this Regulation to the processing of personal data for the purposes of historical research (including references to processing for “historical research purposes”) include processing for the purposes of genealogical research.
5.
References in this Regulation to the processing of personal data for statistical purposes are references to processing for statistical surveys or for the production of statistical results where—
(a)
the information that results from the processing is aggregate data that is not personal data, and
(b)
the controller does not use the personal data processed, or the information that results from the processing, in support of measures or decisions with respect to a particular data subject to whom the personal data relates.”
(2)
In consequence of the amendment made by subsection (1)(a), in section 6 of the 2018 Act (meaning of “controller”), for “4(7)” substitute “4(1)(7)”
.
68Consent to processing for the purposes of scientific research
(1)
Article 4 of the UK GDPR (definitions) is amended as follows.
(2)
In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)”
.
(3)
“6.
A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—
(a)
it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,
(b)
at the time the consent is sought, it is not possible to identify fully the purposes for which personal data is to be processed,
(c)
seeking consent in relation to the area of scientific research is consistent with generally recognised ethical standards relevant to the area of research, and
(d)
so far as the intended purposes of the processing allow, the data subject is given the opportunity to consent only to processing for part of the research.
7.
References in this Regulation to consent given for a specific purpose (however expressed) include consent described in paragraph 6.”
69Consent to law enforcement processing
(1)
The 2018 Act is amended as follows.
(2)
“(1A)
“Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A).”
(3)
“(aa)
section 40A makes provision about processing carried out in reliance on the consent of the data subject,”.
(4)
“40AConditions for consent
(1)
This section is about processing of personal data that is carried out in reliance on the consent of the data subject.
(2)
The controller must be able to demonstrate that the data subject consented to the processing.
(3)
If the data subject’s consent is given in writing as part of a document which also concerns other matters, the request for consent must be made—
(a)
in a manner which clearly distinguishes the request from the other matters,
(b)
in an intelligible and easily accessible form, and
(c)
in clear and plain language.
(4)
Any part of a document described in subsection (3) which constitutes an infringement of this Part is not binding.
(5)
The data subject may withdraw the consent at any time (but the withdrawal of consent does not affect the lawfulness of processing in reliance on the consent before its withdrawal).
(6)
Processing may only be carried out in reliance on consent if—
(a)
before the consent is given, the controller or processor informs the data subject of the right to withdraw it, and
(b)
it is as easy for the data subject to withdraw the consent as to give it.
(7)
When assessing whether consent is freely given, account must be taken of, among other things, whether the provision of a service is conditional on consent to the processing of personal data that is not necessary for the provision of that service.”
(5)
In section 206 (index of defined expressions), in the Table, in the entry for “consent”—
(a)
after “consent” insert “(to processing of personal data)”
,
(b)
for “Part” substitute “Parts 3 and”
, and
(c)
for “section” substitute “sections 33, 40A and”
.