UK GDPR, DPA 2018 and DUAA in clinical practice

Apply the current UK data-protection framework after the Data (Use and Access) Act 2025, including lawful bases, special-category data, purpose limitation, access and rectification.

• Identify the seven current lawful bases.
• Explain the need for both an Article 6 basis and Article 9 condition for health data.
• Apply the data-protection principles to healthcare examples.
• Recognise post-DUAA changes relevant to subject access and automated decisions.
• Distinguish rectification from deletion of accurate historical clinical records.

The UK framework remains the UK GDPR read with the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. The majority of the main Part 5 data-protection changes commenced on 5 February 2026, with section 103 on data-subject complaints commencing later in June 2026.

The current UK framework has seven lawful bases. The new recognised legitimate interests basis sits alongside consent, contract, legal obligation, vital interests, public task and legitimate interests. Public authorities cannot use legitimate interests for processing carried out in performance of their public tasks.

Health data is special category data. Processing normally requires an Article 6 lawful basis plus a separate Article 9 condition, with relevant DPA 2018 safeguards where applicable.

The familiar data-protection principles remain central: lawfulness/fairness/transparency, purpose limitation, data minimisation, accuracy, storage limitation, security and accountability.

Subject access and rectification rights are important but not absolute. A request for access does not mean every document can be released unredacted, and correction of an inaccurate statement does not normally require erasing an accurate historical record of what was documented at the time.

Use CLEAR consistently across information decisions.

1. Clarify the purpose and recipient.
2. Locate the professional and legal authority.
3. Evaluate necessity, proportionality and the minimum information needed.
4. Ask about consent, objections, capacity, statutory duties or powers, and public-interest factors.
5. Record the reasoning, disclosure, advice and safeguards.

CLEAR is an educational scaffold, not a statutory legal test.

Scenario 1. A hospital team assumes explicit patient consent is required as the Article 6 basis for all routine health-data processing.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 2. A patient submits a broad subject access request covering years of records containing third-party information.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

Scenario 3. A patient disputes an old diagnosis and asks that every historical reference be deleted.

Reasoning prompt: clarify purpose and recipient; locate authority; evaluate necessity and minimum information; ask about consent, objections, capacity and risk; record and escalate proportionately.

• There are only six lawful bases.
• Health data always requires explicit GDPR consent.
• A subject access request means release every page unchanged.
• Rectification means rewriting history.

• What exactly is the purpose of using or disclosing the information?
• Who is asking, and have I verified identity and role?
• What professional, common-law, statutory and data-protection authority applies?
• Can the purpose be achieved with less or anonymised information?
• Does the patient expect this use, have they consented or objected, and does that matter in this context?
• Is there a nation-specific rule, local policy or specialist route I need to check?
• What should I document, and who should I consult if uncertain?

Optional reflection: Do not enter identifiable patient, colleague or employer information. Identify one situation in your practice where confidentiality, data protection and local governance could easily be conflated. How would CLEAR improve the reasoning?

• The UK GDPR and DPA 2018 remain the core framework after DUAA.
• There are seven current lawful bases.
• Health data needs an Article 6 basis and an Article 9 condition.
• Public task is common in public healthcare processing.
• Data minimisation applies even where processing is lawful.
• Purpose changes need compatibility and lawful-basis analysis.
• Subject access can require careful redaction and third-party consideration.
• Rectification protects accuracy but does not require falsifying the historical record.
• Significant solely automated decisions require safeguards under the amended framework.
• Data-protection compliance does not replace professional confidentiality analysis.

Check current versions for time-sensitive decisions.

• R4 - UK Government: Data (Use and Access) Act 2025: plans for commencementOpen official source
• R5 - ICO: A guide to lawful basisOpen official source
• R7 - ICO: Special category dataOpen official source
• R10 - ICO: A guide to subject accessOpen official source
• R20 - ICO: Right to rectificationOpen official source