This notice provides additional information about how personal information is used for health and care research and should be read alongside the Trust’s General Privacy Notice and where relevant the Privacy Notice for Patients.

It provides further information about:

• why we use personal information for research;
• what information we may collect and where it comes from;
• the legal basis and safeguards that apply to research;
• how consent to take part in research differs from the legal basis used to process personal information;
• how information may be anonymised or pseudonymised;
• who research information may be shared with;
• how information may be used for further research;
• how long research information may be retained;
• your choices and data protection rights in relation to research; and
• how you can raise a concern about the use of your information.

Health and care research aims to develop knowledge that can improve health, care, treatments and services for patients and the wider public. Research may include clinical trials, studies using health information and other approved health and care research activities.

You should also read any study-specific information provided to you, such as a Participant Information Sheet and consent form. These documents will provide further information about how your personal information will be used for the particular research study and what taking part will involve.

Research undertaken by or involving the Trust will go through the appropriate research governance and ethical review required for the study. Where Research Ethics Committee approval is required, the study will receive the appropriate ethical review before it begins. For more information about the research we do, please visit this link or contact dgft.research.rhh@nhs.net.

The Dudley Group NHS Foundation Trust (referred to in this notice as ‘the Trust’) is the main provider of hospital and adult community services to the populations of Dudley, significant parts of the Sandwell borough and smaller, but growing, communities in South Staffordshire and Wyre Forest.

Our Research and Innovation (R&I) Department supports investigators and researchers from the Trust and partner organisations, helping to ensure that research and innovation activities are undertaken safely, ethically, legally and efficiently. Our researchers are engaged in broad areas of research activities across different clinical specialities.

We are committed to protecting the privacy and security of your personal information at all times.

We use some specific terms throughout this notice. The definitions below explain what these terms mean when we use them in relation to research and your personal information.

Definitions:

• Data Controller

A data controller is the organisation responsible for deciding how and why personal information is processed. The organisation responsible for your information may vary depending on the research study. Your study-specific information will explain who the data controller is and how your information will be used.

• Personal data

Personal data means any information relating to an identified or identifiable individual. This can identify the person either directly or indirectly when put together with other information which may include your name, date of birth, contact details etc.

• Special category of personal data

Special category data is personal information about you which requires additional protection because of its sensitive nature. In health and care research, this may include information such as ethnicity, data concerning health, biometric data, sexual orientation and religious or philosophical belief etc.

• Processing

Processing means anything that is done with the personal data we hold including storing it.

• Pseudonymisation

Pseudonymisation means removing or replacing information that directly identifies you, such as your name or NHS number with a code or other identifier. The additional information needed to link the information back to you is kept separately and securely. Pseudonymised information remains personal data and continues to be protected by data protection legislation.

• Anonymisation

Anonymisation means changing information so that individuals can no longer be identified. Where information has been effectively anonymised, it is no longer personal data.

Clinical research is a core part of the NHS and helps to develop better ways of preventing, diagnosing and treating disease and improving health and care services. This relies on people taking part in research studies and clinical trials so that existing and new treatments, services and approaches can be investigated.

We may use your personal information to carry out health and care research in the public interest. This means that our research must serve a clear purpose for example by improving existing services, develop new treatments or contributing to wider local and national research.

The way we use your personal information for research is governed by data protection legislation including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data (Use and Access) Act 2025 (DUAA).

Where the Trust is the data controller for health and care research, our main lawful basis for processing personal information is:

UK GDPR Article 6(1)(e): processing is necessary for the performance of a task carried out in the public interest

Your health information and other sensitive information used in research is classed as special category data. Where appropriate, our main condition for processing this information for research is:

UK GDPR Article 9(2)(j): processing is necessary for archiving purposes in the public interest, scientific or historical research purposes, subject to appropriate safeguards and relevant requirements of the Data Protection Act (DPA) 2018.

The lawful basis and conditions that apply may depend on the particular research study and the organisation responsible for the research. Study-specific information provided to you will explain how your personal information is being used and who is responsible for it.

Consent to take part in research:

If you are invited to take part in a research study, you will normally be provided with information about the study, including its purpose and any relevant benefits and risks, so that you can make an informed decision about whether you wish to participate.

Recruitment to research studies will follow an appropriate ‘informed consent’ process where consent is required. This means that you will be given relevant information about the research and an opportunity to ask questions before deciding whether you wish to take part. The way consent is sought and recorded may vary depending on the type of research and the applicable legal, regulatory and ethical requirements.

Your consent to take part in a research study is separate from the lawful basis used to process your personal information under data protection legislation. Where the Trust is the data controller for NHS health and care research, we will normally rely on Article 6(1)(e) UK GDPR (public task) and where special category data is processed for scientific research, the relevant Article 9 condition, such as Article 9(2)(j), as explained above.

In some circumstances, a particular research activity or data controller may rely on consent under Article 6(1)(a) UK GDPR and, where special category data is involved, explicit consent under Article 9(2)(a) UK GDPR. Where this applies, it will be explained in the study-specific information provided to you.

UK GDPR Article 6(1)(a): the individual has given consent to the processing of his or her personal data for one or more specific purposes;

UK GDPR Article 9(2)(a): the individual has given explicit consent to the processing of those personal data for one or more specified purposes;

Where you have consented to take part in research, that consent process may also allow confidential patient information to be used in accordance with the common law duty of confidentiality (CDLC). In situations where it is not practical or possible to obtain your consent, support may be sought under Section 251 of the National Health Service Act 2006, following advice from the Confidentiality Advisory Group (CAG). CAG provides independent advice on specific research projects which will use confidential medical information.

The National data opt-out programme allows you to choose whether your confidential patient information can be used for research and planning in certain circumstances.

For research, the National Data Opt-Out generally applies where confidential patient information is being used without consent under Section 251 support. It does not generally apply where you have consented to take part in a particular research study or where anonymised information is being used.

Certain research studies may also require approval from the Health Research Authority (HRA) and a favourable opinion from a Research Ethics Committee (REC). These independent reviews help ensure that research is appropriately governed and considers the rights, safety and wellbeing of participants.

We will often collect the necessary information directly from you as part of the research study.

In other cases, we might already hold the required information due to the healthcare we provide to you. For more information about the information we collect and hold as part of your care, please refer to the Trust’s Privacy Notice for Patients.

Depending on the research study, we may also receive relevant information from other organisations involved in your health and care or from other approved research sources. Your study-specific information will explain what information will be collected, where it will come from and how it will be used.

For research purposes, we may use your information anonymously in reports or presentations or share such information with other NHS bodies.

All information made public will be presented in aggregated format which means that you will not be identifiable from this information.

Some information about you may be linked to other information shared by primary care providers (e.g. GP Practices) and secondary care providers (e.g. Acute Trusts) with the view to creating a more complete information set which will enable medical research for the benefit of public health.

We may use information collected as part of one research project for further research. However, where this information identifies you, we can only use the information for new purposes which are compatible with the original purpose to which you have consented or ethical approval was granted. Where the new purpose is considered to be substantially different, we will obtain separate consent from you or seek new ethical approval.

We will not:

• share your identifiable data with third parties for marketing purposes
• sell your identifiable data

Where we are required to transfer identifiable information about you internationally outside the UK/EU, we will make sure that an adequate level of protection is to be satisfied before the transfer.

For research purposes, we may use anonymised information in reports or presentations or share such information with other NHS bodies.

All information made public will be presented in aggregated or anonymised format, where possible, which means that you will not be identifiable from this information.

Some information about you may be linked to other information shared by primary care providers such as GP Practices and secondary care providers such as NHS Trusts with the view to creating a more complete information set which will enable medical research for the benefit of public health.

We may use information collected as part of one research project for further research where this is permitted by data protection legislation and the appropriate research safeguards are in place. Where identifiable information is proposed to be used for a different research purpose, the relevant legal, confidentiality, ethical and governance requirements will be considered. Where required, further consent or approval will be obtained and further information will be provided to you.

We will not:

• share your identifiable information with third parties for marketing purposes
• sell your identifiable information

Where we are required to transfer identifiable information about you internationally, we will ensure that the transfer complies with applicable data protection legislation and that appropriate safeguards are in place. Your study-specific information will provide further details where international transfers are relevant to your research study.

When you agree to take part in a research study, the information about your health and care may be provided to researchers running research studies here at the Trust and other third-party organisations.

These external organisations may be non-commercial partners such as other hospitals or commercial companies involved in health and care research or new treatments in the UK or abroad.

Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research. Appropriate confidentiality and security arrangements will be in place.

Each research study will have a sponsor, which is the organisation responsible for the overall management of the research. The study may also have researchers at the Trust who are responsible for its day-to-day delivery. Only authorised staff and organisations will be able to access your personal information where necessary for the research and in accordance with the approved research arrangements. Your Participant Information Sheet or other study-specific information will explain who the sponsor is and who your information may be shared with.

Your personal information may be held in paper or electronic form and will only be kept for as long as necessary for the research purpose and in accordance with the Trust’s records management policies, applicable legal and regulatory requirements and the retention period agreed for the particular research study.

The retention period may differ between studies and will be explained in your Participant Information Sheet or other study-specific information.

Where personal information is shared with or processed by other organisations for research purposes, the relevant agreements will set out how the information must be handled, retained and securely deleted or disposed of when it is no longer required.

Research information may need to be retained for an appropriate period to protect the integrity of the research and where relevant the safety of research participants.

You have rights in relation to your personal information under data protection legislation. Further information about these rights and how to exercise them is available in the Trust’s General Privacy Notice.

Depending on the circumstances, these rights may include the right to:

• be informed about how your information is being processed (this notice);
• access a copy of your personal information (also known as right of access or a subject access request);
• request rectification of inaccurate or incomplete personal information;
• erasure in certain circumstances;
• restrict processing in certain circumstances;
• object to processing in certain circumstances;
• data portability which allows you to obtain and reuse your personal data for your own purposes where the right applies;
• rights relating to significant decisions made solely by automated processing, where applicable;

When personal information is used for research, some of these rights may apply differently or may be limited in certain circumstances. Any restriction is not automatic and will only apply where permitted by data protection legislation and where the appropriate research safeguards are in place.

You can withdraw your consent to participate in a research study at any time without giving a reason. However, withdrawing from a study does not necessarily mean that information already collected about you will be deleted. Information already collected may need to be retained to maintain the integrity of the research and meet applicable legal, regulatory or ethical requirements. Your Participant Information Sheet or other study-specific information will explain what happens to your information if you withdraw.

Where possible, research will use the minimum amount of identifiable personal information necessary and appropriate safeguards such as pseudonymisation or anonymisation will be used where suitable.

If you have any questions or concerns about how your personal information is being used for research, please contact the Trust’s Data Protection Officer using the details below.

The Data Protection Officer
Information Governance Team
South Block, 2^nd Floor,
Russells Hall Hospital,
Pensnett Road,
Dudley, West Midlands
DY1 2HQ
Telephone: 01384 456 111 Ext: 1208
Email: dgft.dpo@nhs.net

If you require this privacy notice in an alternative format, accessible version or another language, please contact the Information Governance Team at dgft.info.gov@nhs.net and we will make reasonable efforts to meet your needs.

If you remain dissatisfied after contacting the Trust about the way Trust has handled your personal information, you have right to make a complaint to Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF
Telephone: 0303 123 1113

If you require any Information Governance, Data Protection or Freedom of Information policies, these are available on request from dgft.foi@nhs.net.

The latest version will always be available on Trusts website.

It was last updated in August 2026.