Anonymising Research-Cohort Datasets for HRA Studies – UK GDPR-compliant anonymisation per Health Research Authority guidance
A research-cohort dataset is a structured collection of special-category health data compiled for a Health Research Authority-approved study, linking patient identifiers to longitudinal outcomes under UK GDPR Article 9. The HRA approves around 6,000 projects per year; NHS Digital holds over 30,000,000 GP records. anonym.legal pseudonymises direct and indirect identifiers, preserving analytical variables and biomarker values for the approved research purpose.
When this applies
This task applies when a research team is preparing a cohort dataset for analysis under an HRA-approved protocol and requires pseudonymisation of participant identifiers before the dataset is transferred to the analysis team or uploaded to a safe haven environment. Breaches of research participant confidentiality can attract fines of up to £17.5 million or 4% of annual global turnover under DPA 2018 s.157.
How anonym.legal handles it
- Upload the cohort dataset (CSV, XLSX, or SAS format) to anonym.legal.
- The engine identifies direct identifiers (name, NHS number, date of birth, postcode) and flags quasi-identifiers (age, sex, rare diagnosis codes) for review.
- Direct identifiers are replaced with consistent participant pseudocodes.
- Quasi-identifier combinations are reported to the researcher for a disclosure-risk assessment before the dataset is released.
- Outcome variables, biomarker values, and survey responses are preserved; date variables are generalised to month/year where full dates carry re-identification risk.
- A mapping table linking pseudocodes to real participant identities is stored with UK data residency under the Data Controller's access policy.
What you provide
- Cohort dataset file (CSV, XLSX, or SAS)
- Data dictionary describing all variables and their sensitivity level
- HRA approval reference and approved data-minimisation plan
Limitations & cautions
- HRA guidance requires researchers to demonstrate data minimisation; pseudonymisation alone may not satisfy requirements for datasets with high quasi-identifier density — obtain a statistical disclosure-control report. According to the ICO's Anonymisation Code of Practice (2012, updated 2021–22), pseudonymisation does not produce anonymous data; it remains personal data under UK GDPR.
- The tool does not assess whether the research falls within the scope of the HRA ethics approval — confirm with your Research Ethics Committee.
- Date-of-birth generalisation to age bands may reduce analytical precision; agree the generalisation strategy with the Chief Investigator before processing.
FAQ
Does HRA guidance require full anonymisation or is pseudonymisation sufficient for safe-haven data transfers?
HRA guidance supports pseudonymisation as an appropriate protection measure for approved health research, particularly within NHS Digital safe-haven environments. Full anonymisation (irreversible) may be required for public data releases. Confirm with your HRA-approved data access agreement. The HRA approves around 6,000 research projects per year, many of which rely on pseudonymised cohort extracts transferred to accredited safe havens.
Can the engine handle cohort datasets with linked hospital episode statistics?
Yes. Linked HES data joined to cohort records is processed in a single batch. The same participant pseudocode is applied across cohort and HES tables, preserving linkage keys while removing identifiable fields. The NHS Records Management Code of Practice 2023 requires adult health records to be retained for 8 years from the end of treatment — cohort datasets derived from NHS records must respect this obligation.
How does the engine handle rare disease codes that act as quasi-identifiers?
The engine flags rare diagnosis codes (those appearing in fewer than a configurable threshold of participants in the dataset) for researcher review. The researcher decides whether to suppress, aggregate, or retain those codes before final pseudonymisation. The 8 Caldicott Principles (updated 2013, Principle 8 added 2020) require that data flows are minimised and documented.