Institute of Epidemiology & Health Care


Data processing

UCL is required by law to comply with data protection legislation such as the Data Protection Act 2018 (DPA) and the General Data Protection Regulation (GDPR) which require that we provide all study participants with additional details regarding the legal basis that allows us to hold their personal data. 

Data Processing at UCL

As a University, UCL uses personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner's Office (ICO).

UCL's Data Protection Officer can be contacted on data-protection@ucl.ac.uk.

Further information can be found by clicking the links below: