Personal data used for research purposes must be used in accordance with the Data Protection Act 1998 (DPA).
A detailed guide produced by the University of Reading to advise on how do deal with the common issues that arise in connection with the protection of personal data collected by researchers in the course of their project work. A very useful and well-structured set of web pages.
The rights and obligations set out in the DPA are designed to apply generally, but there are certain exemptions to accommodate special circumstances. One such exemption is where personal data are processed for research purposes; this includes statistical or historical purposes. The personal data must have no other use, not even incidental use. The term “research purposes” is not defined in the Act.