Research Data Governance Framework — SCE Palliative Medicine MCQ

Correct answer: C — The Data Protection Act 2018/UK GDPR and the Health Research Authority framework – patient data can be used for research with consent, or without consent if approved by a research ethics committee and the Confidentiality Advisory Group (CAG).

Explanation lettering: E = shown as A · C = shown as B · A = shown as C · B = shown as D · D = shown as E

Option A is correct. Under UK law, processing of patient data for research is governed by the Data Protection Act 2018 (which incorporates UK GDPR) and the common‑law duty of confidentiality. Research may proceed with explicit patient consent. If consent is impracticable, Section 251 support via the Confidentiality Advisory Group (CAG), together with research ethics committee approval (via HRA), permits use of confidential patient information without consent. Distractors are clearly incorrect: B is false—no Act of Parliament is required per study; C is wrong—anonymisation is not infallible and even anonymised data may require ethical oversight; D and E are incompatible with established UK research governance.

Reference: NHS England Digital. Protecting patient data (DPA 2018/UK GDPR, duty of confidentiality, Section 251 CAG). Health Research Authority. Use of patient data in research (CAG and REC route when consent not feasible). https://digital.nhs.uk/services/national-data-opt-out/understanding-the-national-data-opt-out/protecting-patient-data