3. Such references—
(a) include processing for the purposes of technological development or demonstration, fundamental research or applied research, so far as those activities can reasonably be described as scientific, but
(b) only include processing for the purposes of a study in the area of public health that can reasonably be described as scientific where the study is conducted in the public interest.
4. References in this Regulation to the processing of personal data for the purposes of historical research (including references to processing for “historical research purposes”) include processing for the purposes of genealogical research.
5. References in this Regulation to the processing of personal data for statistical purposes are references to processing for statistical surveys or for the production of statistical results where—
(a) the information that results from the processing is aggregate data that is not personal data, and
(b) the controller does not use the personal data processed, or the information that results from the processing, in support of measures or decisions with respect to a particular data subject to whom the personal data relates. ”
(2) In consequence of the amendment made by subsection (1)(a), in section 6 of the 2018 Act (meaning of “ controller ”), for “4(7)” substitute “4(1)(7)” .
I118 S. 67 not in force at Royal Assent, see s. 142(1)
I119 S. 67 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(a)
68 Consent to processing for the purposes of scientific research U.K.
(1) Article 4 of the UK GDPR (definitions) is amended as follows.
(2) In point (11) of paragraph 1 (definition of “consent”), at the end insert “(and see paragraphs 6 and 7 of this Article)” .
(3) After paragraph 5 (inserted by section 67 of this Act) insert—
“ 6. A data subject’s consent is to be treated as falling within the definition of “consent” in point (11) of paragraph 1 if—
(a) it does not fall within that definition because (and only because) the consent is given to the processing of personal data for the purposes of an area of scientific research,
(b) at the time the consent is sought, it is not possible to identify fully the purposes for which personal data is to be processed,
(c) seeking consent in relation to the area of scientific research is consistent with generally recognised ethical standards relevant to the area of research, and
(d) so far as the intended purposes of the processing allow, the data subject is given the opportunity to consent only to processing for part of the research.
7. References in this Regulation to consent given for a specific purpose (however expressed) include consent described in paragraph 6. ”
I120 S. 68 not in force at Royal Assent, see s. 142(1)
I121 S. 68 in force at 5.2.2026 by S.I. 2026/82 , reg. 2(b)
69 Consent to law enforcement processing U.K.
(1) The 2018 Act is amended as follows.
(2) In section 33 (definitions), after subsection (1) insert—
“ (1A) “Consent” of the data subject to the processing of personal data means a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of the personal data (and see section 40A). ”