ICO consults on updated guidance for research, archiving and statistical purposes

The Information Commissioner’s Office (ICO) has recently closed consultation on its draft updated guidance on the “research, archiving and statistics” (RAS) provisions under UK data protection law. The update reflects legislative developments under the Data (Use and Access) Act 2025 (DUAA) and is intended to provide greater clarity for organisations relying on these provisions.

The RAS provisions enable organisations to process personal data for scientific or historical research, archiving in the public interest, and statistical purposes, subject to appropriate safeguards.

The updated draft guidance implemented by the ICO aims to clarify how organisations can rely on the RAS provisions in practice and how the key data protection principles apply in a research and analytics context.

Key takeaways

Broader concept of “research”

The ICO confirms a flexible interpretation of “research”, which is not limited to academic or scientific institutions. Organisations can rely on the research provisions where activities are genuinely aimed at generating new knowledge or insights, rather than solely supporting operational decision-making.

Interactions with purpose limitation

A central feature of the RAS regime is that further processing for research, archiving or statistical purposes is not considered incompatible with the original purpose of collection, provided appropriate safeguards are in place. The updated guidance provides more detailed commentary on when this compatibility presumption will apply and how organisations should document their reasoning.

Safeguards & data minimisation

The draft guidance emphasises the importance of technical and organisational safeguards, including, which must be tailored to the nature and the risk of the processing being undertaken. These safeguards include:

• Data minimisation and pseudonymisation where possible

• Strict access controls

• Ensuring processing does not cause substantial damage or distress to data subjects.

Data subjects rights & exemptions

The RAS provisions allow certain derogations from data subject rights (such as access and rectification) where exercising those rights would seriously impair the research or statistical purpose. The updated guidance clarifies:

• When these exemptions can be relied upon

• The requirement to apply them narrowly and justify their use.

Anonymisation & statistical outputs

The ICO further reiterates the distinction between anonymisation of data and pseudonymisation data. The guidance highlights that pseudonymous data remains personal data, and therefore where controllers are capable of combining such data with other information to re-identify an individual, the processing will not qualify for statistical purposes. Organisations must therefore ensure that outputs of research or statistical processing do not enable re-identification of individuals.

Our views

Organisations undertaking research, analytics or data-driven innovation should:

• Review existing processing activities to determine whether they can rely on the RAS provisions

• Document compatibility assessments where personal data is repurposed for research or statistical use

• Implement proportionate safeguards, particularly where large datasets or sensitive data are involved

• Assess reliance on exemptions from data subject rights carefully and ensure they are justified.

The ICO closed its consultation process seeking stakeholder feedback on 5 May 2026, with the final version of the guidance expected later in 2026. As the final guidance may introduce further refinements, it is important that organisations should monitor the outcome of the consultation.