DPA 2018 Sch 2 Para 27: Research Exemption

Data Protection Act 2018, Schedule 2, Paragraph 27 (Research Exemption)

The provision in Part 6 of Schedule 2 to the UK Data Protection Act 2018 that lets a controller processing personal data for research or statistical purposes disapply specific UK GDPR data-subject rights -- the right of access (Article 15(1)-(3)), rectification (Article 16), restriction of processing (Article 18(1)), and objection (Article 21(1)) -- to the extent that applying them would prevent or seriously impair achievement of the research or statistical purposes, provided the processing also satisfies the UK GDPR's research-safeguards requirements. The access-right disapplication carries an additional, narrower condition: it applies only where the results of the research or any resulting statistics are not made available in a form that identifies a data subject.

ByCASRAI Editorial Board

· Last updated 3 Aug 2026

Ask about Data Protection Act 2018, Schedule 2, Paragraph 27 (Research Exemption)

Answers are drawn from this dictionary entry and the rest of the CASRAI corpus, with a link to every source.

Answers are AI-generated from CASRAI’s own published pages and can be wrong, so check the linked sources before relying on one; your question is logged without personal data — never sold, never used to train a third-party model — to show us what CASRAI is missing, so please do not type personal or confidential details. How we use this

Examples

Worked examples

Is an instance
A university running a five-year longitudinal health cohort relies on paragraph 27 to decline a participant's mid-study Article 16 rectification request where correcting the historical record would compromise the integrity of already-collected longitudinal measures, while still honouring the request going forward for new data collection.
Is an instance
A research team publishing aggregate statistics from a survey dataset disapplies the Article 15 access right for individual respondents because the published outputs report only group-level statistics and do not identify any data subject -- satisfying the condition attached to that specific disapplication.

Counter-examples

Looks similar, but isn't

Not an instance
A controller cannot rely on paragraph 27 to ignore an access request purely because responding is administratively inconvenient or time-consuming -- the test is whether compliance would prevent or seriously impair the research purposes, not general burden.
Not an instance
A controller processing identifiable data for operational service-improvement purposes, rather than research or statistics, cannot invoke paragraph 27 at all -- the exemption is scoped to the research/statistics purpose, not to the sector or institution doing the processing.

Machine-readable encodings

Use in your systems

JATS XML <role> element

xml

<role vocab="credit"
      vocab-identifier="https://casrai.org/dictionary/"
      vocab-term="Data Protection Act 2018, Schedule 2, Paragraph 27 (Research Exemption)"
      vocab-term-identifier="https://casrai.org/dictionary/term/data-protection-act-2018-schedule-2-paragraph-27" />

Schema.org DefinedTerm (JSON-LD)

json

{
  "@context": "https://schema.org",
  "@type": "DefinedTerm",
  "@id": "https://casrai.org/dictionary/term/data-protection-act-2018-schedule-2-paragraph-27",
  "name": "Data Protection Act 2018, Schedule 2, Paragraph 27 (Research Exemption)",
  "identifier": "https://casrai.org/dictionary/term/data-protection-act-2018-schedule-2-paragraph-27",
  "description": "The provision in Part 6 of Schedule 2 to the UK Data Protection Act 2018 that lets a controller processing personal data for research or statistical purposes disapply specific UK GDPR data-subject rights -- the right of access (Article 15(1)-(3)), rectification (Article 16), restriction of processing (Article 18(1)), and objection (Article 21(1)) -- to the extent that applying them would prevent or seriously impair achievement of the research or statistical purposes, provided the processing also satisfies the UK GDPR's research-safeguards requirements. The access-right disapplication carries an additional, narrower condition: it applies only where the results of the research or any resulting statistics are not made available in a form that identifies a data subject.",
  "inDefinedTermSet": "https://casrai.org/dictionary/domain/compliance-regulatory#set",
  "url": "https://casrai.org/dictionary/term/data-protection-act-2018-schedule-2-paragraph-27",
  "sameAs": [],
  "license": "https://creativecommons.org/licenses/by/4.0/",
  "publisher": {
    "@id": "https://casrai.org/#organization"
  },
  "dateModified": "2026-08-03T22:41:14",
  "inLanguage": "en"
}