Data can be invaluable in research projects. Research involving individuals can be enriched and strengthened by having supporting information from national registers and the National Health Services. However, appropriate controls need to be in place to protect the information provided, beyond the university’s security requirements.
At a Glance
- Know what data you need for the project
- Know who to request the information from
- Understand how to safeguard the information
- You may need additional approvals to be able to request the information
The Basics:
Before starting a data application, it is important to know what information you will require, and who the custodian for that data is. Wherever possible, it is good practice to identify the bare minimum information you may need to answer your research question, as it minimises the risk, and is often easier to have approved as it shows good practice in data management.
Do you need Identifiable data?
In the world of GDPR and Data Protection, identifiable data is any information that can directly identify a natural person (that is, a living individual). Some of this information may be available to the public (that is, via electoral registers, land registry, etc.) and therefore may not be typically classed as ‘confidential’ or ‘sensitive’.
While it may seem like a good idea to request more information just in case you may need it, if your research question doesn’t require study of cohorts, and requires only statistical information, the process is different to having to request information on individuals.
Typically you will have to provide information on how you will safeguard the information, and what you will use it for. It is good practice to think through the ways in which the confidentiality, integrity, or availability of the information would affect your research project, and put in place measures to reduce the risk of these scenarios happening. You can find the University’s requirements for information security here.
For statistical data with no identifiable information, you should contact the relevant data custodian, and complete the application process. Please get in touch via infosec@it.ox.ac.uk if you require help with the application.
