Data Protection Act 2018, Section 19 (Research Safeguards)

Data Protection Act 2018, Section 19 (‘Processing for archiving, research and statistical purposes: safeguards’) was the UK domestic legislation that supplied the ‘appropriate safeguards’ UK GDPR Article 89(1) requires when personal data is processed for scientific/historical research, archiving in the public interest, or statistics — most often the safeguards relied on alongside the Schedule 1, Part 1, paragraph 4 condition for processing special category data. It has since been omitted: Section 19 was repealed with effect from 5 February 2026 by the Data (Use and Access) Act 2025 (sections 86(6) and 142(1), commenced by the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026, regulation 2(n)). The substantive safeguards did not disappear — they were relocated into new UK GDPR Articles 84B and 84C, which now govern processing for ‘RAS purposes’ (research, archiving, statistics). This term is kept as a reference point because researchers, IRB/REC members, and data-protection officers still encounter ‘Section 19’ in older policies, consent templates, and data-sharing agreements drafted before February 2026.

What Section 19 required (and what its successor requires)

Both the former Section 19 and the current Articles 84B/84C impose the same two core conditions on RAS-purpose processing, in addition to the general UK GDPR lawful-basis and special-category-condition requirements:

• No likely substantial damage or distress. The processing must not be likely to cause substantial damage or substantial distress to a data subject.
• No decisions about a particular individual, unless approved medical research. The processing must not be carried out for the purpose of measures or decisions with respect to a particular data subject — unless the processing is for ‘approved medical research’, meaning medical research approved by a research ethics committee recognised or established under Chapter 2, Part 3 of the Care Act 2014 (the Health Research Authority’s REC framework), or an equivalent recognised research-ethics body.

A processing activity that fails either condition cannot rely on the RAS safeguards route, and in turn cannot benefit from the linked research exemptions (for example the disapplication of certain data-subject rights under Data Protection Act 2018, Schedule 2, Part 6, paragraph 27, where complying with those rights would prevent or seriously impair the research).

Why the change happened

The Data (Use and Access) Act 2025 restructured several UK GDPR research provisions, moving safeguards that had lived in the UK’s domestic Data Protection Act 2018 directly into the UK GDPR text itself as Articles 84B and 84C. For research administrators, the practical effect is largely one of citation rather than substance: policies, DPIAs, and data-sharing agreements that still cite ‘DPA 2018, section 19’ as the source of the substantial-damage/distress and no-individual-decisions safeguards should be updated to cite UK GDPR Articles 84B/84C instead, since section 19 itself no longer exists in force.

UK domestic law vs EU GDPR — why this term is UK-specific

Section 19 (and now Articles 84B/84C) is part of the UK GDPR regime — the retained, UK-amended version of the EU General Data Protection Regulation that has applied in the UK since the end of the Brexit transition period, read together with the Data Protection Act 2018 as the UK’s domestic implementing statute. The EU GDPR’s own Article 89(1) also requires ‘appropriate safeguards’ for research processing, but each EU member state supplies its own domestic safeguards legislation to satisfy that requirement — the UK’s are not the same instrument, and a study governed purely by EU law (with no UK-established controller, processor, or UK data subjects in scope) does not rely on DPA 2018 Section 19 or UK GDPR Articles 84B/84C at all. See the related GDPR terms below for the EU-GDPR-level concepts these UK provisions build on.

Illustrative example

A UK university running a longitudinal health-outcomes study, processing special category (health) data under the Schedule 1, Part 1, paragraph 4 research condition, historically documented in its Data Protection Impact Assessment that the processing was ‘not likely to cause substantial damage or distress’ and was not used to make decisions about specific participants, citing DPA 2018 section 19 as the legal basis for those safeguards. A DPIA reviewed or drafted after 5 February 2026 would state the identical safeguards but cite UK GDPR Articles 84B and 84C instead — the compliance obligation is unchanged, only the citation moves.

Counter-example

A processing activity that feeds an individual participant’s data into a decision about that specific person — for instance using research data to decide whether to change an individual’s clinical care outside an approved-medical-research pathway — does not qualify for the RAS safeguards route under either the former section 19 or the current Articles 84B/84C, regardless of how the data was originally collected.

Related terms

• Data Protection Act 2018, Schedule 2, Paragraph 27 (Research Exemption) — the linked exemption from specific data-subject rights that depends on meeting the RAS safeguards.
• GDPR Article 5(1)(b): Purpose Limitation and Compatible Research Use
• GDPR Article 6(1)(e): Public Task Legal Basis
• GDPR Recital 33: Broad Consent for Scientific Research
• MRC Guidance: GDPR Lawful Basis and Common Law Confidentiality
• Guide: Data Protection Act 2018 in Health and Social Care Research

Sources: legislation.gov.uk, Data Protection Act 2018, section 19 (as amended, showing the 5 February 2026 omission) and Schedule 1, Part 1; Data (Use and Access) Act 2025, sections 86(6) and 142(1); the Data (Use and Access) Act 2025 (Commencement No. 6 and Transitional and Saving Provisions) Regulations 2026.