In general terms, the justification on which personal information can be used and processed for research purposes requires selecting the rightful legal basis under GDPR. A valid legal basis should be identified prior to processing and should also be documented alongside relevant legislation, if necessary. The choice of legal basis depends on the purpose of the data processing and a legal gateway must also be identified if datasets are to be linked.
The below list highlights the relevant legislation and frameworks. You can also read more about the relevance and application of the various provisions here.
- General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data
- Data Protection Act 2018
- Digital Economy Act 2017
- Human Rights Act 1998
- Statistics and Registration Service Act 2007
- The Scottish Government Identity Management and Privacy Principles
- The Scottish Government’s Guiding Principles for Data Linkage
- The Scottish Government’s Joined Up Data for Better Decisions Strategy