Keeping research data safe: safe people and safe organisations

The NHS Research Secure Data Environment (SDE) Network has been developed over the past 4 years with 2 fundamental objectives: to enable timely and efficient access to data for researchers, and to do so without compromising the safety, security, or transparency required to maintain public trust.

Our newly launched Registration Service exemplifies how these objectives can be achieved simultaneously. Its development required co-ordinated thinking, extensive collaboration across the SDE Network, and the continuous involvement of patients and the public.

Accessing data for research can be a complex and lengthy process. Before being granted access, researchers must demonstrate that their project is valid and serves the public good. They then work with the SDE Network which ensures they access only the minimum data necessary to address their research question. In addition, researchers must evidence their competence in handling data, their understanding of how to work safely within secure environments, their individual responsibilities, and the alignment of their employing organisation with NHS values and regulatory requirements.

To access routine health data through the SDE Network, researchers must satisfy the Five Safes: Safe Projects, Safe People, Safe Data, Safe Outputs and Safe Settings. The SDEs provide the safe setting and safe data and undertake checks on outputs. Researchers must demonstrate that their project will provide a public benefit and that they meet the standards required to be regarded as 'safe people' — a requirement that can be challenging.

To streamline the 'Safe People' component while maintaining high standards, we have introduced the Registration Service. This enables researchers to demonstrate once that they meet the necessary criteria, and that their employing organisation also meets our requirements. This information is recorded in a central register accessible across the SDE Network. Registration may be completed in advance of submitting a research project, which is then reviewed separately, including by an independent data advisory committee comprising public representatives.

Although the concept appears straightforward, its implementation required significant effort. Achieving consensus across all SDEs on the criteria for assessing safe people and safe organisations was essential. Equally important was ensuring that these criteria reflected public expectations and were practical for researchers. Our aim was to create a process that improved efficiency for users while reducing administrative burden across the SDE Network.

We began by drawing on insights from national public deliberations exploring expectations regarding the use of data for research. To test and refine our thinking further, we conducted a series of deliberative workshops. These sessions explored complex issues and gathered a diverse range of public views, providing a robust evidence base for refining the criteria. One significant change was the name of the process – what we now call registration was initially known as 'validation'. Feedback from the public was that registration better reflects its role as just one step in a rigorous process: by itself registration does not permit access to data.

We then tested the approach with researchers to ensure it was practical, proportionate, and provided the necessary assurance. A pilot phase followed, during which the service was further tested with a small number of users and adjusted to address any operational challenges.

We believe that transparency is essential and, in line with public expectation, we will continue to publish information about projects approved by data access committees.

The Registration Service will undergo ongoing review to ensure it continues to meet user needs and reflects evolving best practice. This approach — grounded in public involvement, designed to support researchers, and uncompromising in its commitment to safety, security and ethics — will underpin all services delivered through the SDE Network.