Skip to navigation Skip to main content Skip to footer

UK Biobank data and GDPR

UK Biobank data and GDPR

In 2018, the General Data Protection Regulation (GDPR) came into force and the complementary Data Protection Act 2018 was also enacted, replacing all previous UK data protection legislation. As a consequence, we wrote to all of participants in UK Biobank to explain that the new legislation does not result in any material change in the underlying nature of their relationship with UK Biobank. This page should be read in conjunction with that guidance.

Not surprisingly, the introduction of the GDPR has given rise to a number of questions and queries from various parties, including researchers using UK Biobank data and the custodians of data related to both primary care (e.g. GP records), such as GP practices and clinical commissioning groups, and to secondary care (e.g. hospital, death and cancers records). This page aims to address those questions.

The Participant GDPR note

Background and underlying definitions 

Background and underlying definitions 

Data controller: 

UK Biobank was a data controller under the old legislation and it remains a data controller for the purposes of the GDPR. As such, UK Biobank has an obligation to ensure that:

  • It complies with the provisions of the GDPR in the way that it manages the data within the UK Biobank resource (that it has for UK Biobank participants)
  • Third parties who process or use UK Biobank data do so too.

Lawful basis: 

In UK Biobank’s note to participants about GDPR, we explained that we were using two lawful bases for processing their data, namely legitimate interests (which is a new category under the GDPR) and explicit consent (an updated version of consent under the previous law).

As and when required, we are specific about which basis is being used for a particular activity; for example, when UK Biobank currently links to secondary health care data (such as hospital events and death and cancer information) through NHS Digital, it uses legitimate interests as the appropriate lawful basis.


The explicit consent that was obtained when participants joined UK Biobank in 2006-10 remains compliant with the GDPR on the basis that:

  • The form and text of the consent obtained from every participant (it was not possible to join UK Biobank without completing the consent form)
  • The information provided to participants prior to them joining UK Biobank (which has been reinforced subsequently) about the collection and use of information about them
  • The right of each participant to unilaterally withdraw from UK Biobank at any time.

In light of the above, UK Biobank has no current plans to seek further or additional consent from participants.

GDPR and research uses

Not personal data:

As a consequence, researchers are not provided with data about participants that would be defined as “personal data” under the GDPR (the provisions of the GDPR, and data protection generally, only address data which is personal data). In addition, UK Biobank’s Material Transfer Agreement (MTA) prohibits researchers from trying to re-identify participants.

View MTA

Research uses:

All data provided by UK Biobank to approved researchers for their research are de-identified as researchers do not need to know the identity of participants in order to conduct their research.

De-identified data:

UK Biobank goes to considerable lengths to ensure that, as far as is practically possible, it only uses de-identified data in all its internal and external processes. Identifying data is only used when we contact UK Biobank participants directly.

Data security:

UK Biobank expects researchers who use its data to adhere to very high standards of data security in terms of storing and processing UK Biobank data. Again, they are required to commit to doing so by the MTA and, to date, we are not aware of any such breach.

A breach of these requirements would be taken very seriously by UK Biobank, including implementation of a prohibition on the defaulting organisation receiving any further access to UK Biobank data.

Last updated