DUAA 2025: key changes to “scientific research” in UK data law

Definition of scientific research

Once the relevant provisions come into force, Article 4 (Definitions) of the UK GDPR will be amended to provide a broader and more permissive framework for the use of personal data in scientific research. Under section 67(1)(b) DUAA, “scientific research” is clarified to include “any research that can reasonably be described as scientific, whether publicly or privately funded and whether carried out as a commercial or non-commercial activity.”

The DUAA expressly confirms that this includes processing personal data for:

• Technological development or demonstration, fundamental research, or applied research (where these activities can reasonably be described as scientific); and
• Studies conducted in the public interest in the area of public health.

Impact of the change

Whilst this change aligns with existing UK GDPR recitals and guidance permitting broad interpretation of "scientific research", the DUAA now gives this wider definition statutory force. This should provide greater clarity on what qualifies as “scientific research” when seeking to rely on exemptions from certain data processing restrictions under the UK GDPR (such as the purpose limitation principle and compliance with data subject rights) provided that appropriate safeguards, including data minimisation, are in place. The change is expected to reduce compliance burdens for CROs, academic institutions, and private companies engaged in research. More broadly, it aims to encourage and facilitate innovation, particularly in the healthcare and technology sectors.

The DUAA also clarifies that, in certain circumstances, data subjects may give "broad consent" for processing of their personal data for scientific research where specific purposes cannot be fully identified at the time of consent, provided that (i) seeking consent is consistent with generally recognised ethical standards relevant to the area of research; and (ii) where feasible, individuals are given the option to consent only to processing for part of the research. This again codifies the approach in the UK GDPR recitals as binding UK law.

Timing and next steps

The relevant provisions need to be implemented via secondary legislation, expected to take effect six months after Royal Assent (anticipated around December 2025). The ICO has announced plans to issue further guidance on processing for research, archiving and statistical purposes in Spring 2026.

Click here for an overview and summary of the other key changes introduced by the DUAA.

If you have any questions or would like to discuss the implications in more detail, please do not hesitate to get in touch.