The Health Research Authority have issued guidance specifically aimed at researchers, site and sponsors managing individual research projects. The guidance document can be found here.
The HRA have now issued recommended wording to fulfil transparency requirements under the GDPR to be used in Participant Information Sheets and/or participant facing documentation. The wording can be found here.
Where research studies are solely sponsored by the University of Cambridge, the following HRA wording should be used on the participant information sheet or participant facing documentation:
“The University of Cambridge is the sponsor for this study based in [the United Kingdom/ country]. We will be using information from [you and/or your medical records] in order to undertake this study and will act as the data controller for this study. This means that we are responsible for looking after your information and using it properly. The University of Cambridge will keep identifiable information about you [for x years after the study has finished/ until x].
Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
You can find out more about how we use your information https://www.medschl.cam.ac.uk/research/privacy-notice-how-we-use-your-research-data/“
The Medical Research Council Regulatory Support Centre have a useful GDPR resources page https://mrc.ukri.org/research/facilities-and-resources-for-researchers/regulatory-support-centre/gdpr-resources/ The guidance has been developed in consultation with the Information Commissioners Office and is updated regularly.
The MRC have produced the following new GDPR resources:
GDPR and Data Protection Act 2018 GDPR: What do I need to do?
Further information and up to date guidance issued by the Health Research Authority can be found on the HRA website.
Guidance on the University of Cambridge’s expectations for researchers whose academic research involves the processing of personal data is available here.
