Cookies on this website
We use cookies to ensure that we give you the best experience on our website. If you click 'Continue' we'll assume that you are happy to receive all cookies and you won't see this message again. Click 'Find out more' for information on how to change your cookie settings.
Skip to main content

Guidance on how to determine the lawful basis for processing personal data. This is a key part of a privacy notice. Please use the University / Research Services Guidance in the first instance. Other links are provided to clarify difficult areas.

University: official lawful basis guidance

University guidance on how to determine the lawful basis for processing personal data.

How to carry out a legitimate interests assessment

The University's guide to determining whether legitimate interest can be used as a lawful basis for processing (includes links to templates and examples)

Using consent as a lawful basis for processing

The University's guidance on when and how to use consent as a lawful basis for processing

Research Services: lawful basis guidance for research projects

Research Services guidance on selecting a lawful basis for research. It isn't possible to link directly to the relevant information, please go to: Lawful - selecting a lawful basis for the processing of personal data

Health Research Authority advice on Consent in Research

This link is provided as a very clear outline and contrast of the use of consent under GDPR and the common law duty of confidentiality, and is included here for clarification if things are getting confusing. Please use Research Services Guidance in the first instance.

Consent under the Common Law Duty of Confidentiality

A useful link to the Department of Health guidance on consent under the common law. It is important not to confuse this with consent as a basis for processing under the GDPR. This link is included as a good starting point if things are getting confusing - please check the Research Services advice on this.