Skip to main content

Legal basis

A legal basis explains the lawful reason why health and care data can be accessed and used within a Secure Data Environment. For the TVS SDE, this means making sure that any use of confidential patient information is supported by the right approvals, safeguards, and conditions before data access is granted. This helps protect patients and the public while enabling approved research that can improve health and care.

The Health Research Authority (HRA) has given Section 251 support, following advice from their Confidentiality Advisory Group (CAG), for the development of the Thames Valley and Surrey Secure Data Environment. This provides the legal basis to allow access to the specified confidential patient information without asking for consent. (CAG reference: 23/CAG/0046)

Researchers can choose to rely on the TVS SDE legal basis for accessing data where their project falls within the scope of the existing approvals and conditions. If they do not use the TVS SDE legal basis, they must clearly explain the alternative legal basis they are relying on, including the relevant lawful basis under UK GDPR Article 6, the condition for processing special category data under UK GDPR Article 9, and how they have met the requirements of the common law duty of confidentiality.

Re-Identifiable Data

Researchers can apply to bring external datasets into the research environment to be linked with prepared extracts of data from the TVS SDE. Re-identification may be possible if TVS SDE data is linked with other information about the same people, or if a person has a rare or unusual combination of characteristics that could allow their identity to be worked out. UK GDPR compliance will be applicable.

If linking these datasets could make the data re-identifiable to the researcher, using any means reasonably likely to be available to them, the Lead Organisation must demonstrate that:

  • the common law duty of confidentiality has been satisfied; and
  • lawful bases are in place from UK GDPR Articles 6 and 9.

Additional REC approval will also be required, as well as Section 251 support via CAG if explicit consent for accessing identifiable data for research purposes has not been given.

For further guidance, see Can we identify an individual indirectly from the information we have (together with other available information)?.