Regulation (EU) 2016/679 as retained in UK law (UK GDPR) – Article 84C – Appropriate safeguards
Articles
Article 84C[F1Appropriate safeguards
1. This Article makes provision about when the requirement under Article 84B(2) for processing of personal data to be carried out subject to appropriate safeguards is satisfied.
2. The requirement is not satisfied if the processing is likely to cause substantial damage or substantial distress to a data subject to whom the personal data relates.
3. The requirement is not satisfied if the processing is carried out for the purposes of measures or decisions with respect to a particular data subject to whom the personal data relates, except where the purposes for which the processing is carried out include the purposes of approved medical research.
4. The requirement is only satisfied if the safeguards include technical and organisational measures for the purpose of ensuring respect for the principle of data minimisation (see Article 5(1)(c)), such as, for example, pseudonymisation.
5. In this Article—
- “approved medical research” means medical research carried out by a person who has approval to carry out that research from—
- (a)a research ethics committee recognised or established by the Health Research Authority under Chapter 2 of Part 3 of the Care Act 2014, or
- (b)a body appointed by any of the following for the purpose of assessing the ethics of research involving individuals—
- (i)the Secretary of State, the Scottish Ministers, the Welsh Ministers or a Northern Ireland department;
- (ii)a relevant NHS body;
- (iii)United Kingdom Research and Innovation or a body that is a Research Council for the purposes of the Science and Technology Act 1965;
- (iv)an institution that is a research institution for the purposes of Chapter 4A of Part 7 of the Income Tax (Earnings and Pensions) Act 2003 (see section 457 of that Act);
- (i)
- (a)
- “relevant NHS body” means—
- (a)an NHS trust or NHS foundation trust in England,
- (b)an NHS trust or Local Health Board in Wales,
- (c)a Health Board or Special Health Board constituted under section 2 of the National Health Service (Scotland) Act 1978,
- (d)the Common Services Agency for the Scottish Health Service, or
- (e)any of the health and social care bodies in Northern Ireland falling within paragraphs (b) to (e) of section 1(5) of the Health and Social Care (Reform) Act (Northern Ireland) 2009 (c. 1 (N.I.)).]
- (a)
Amended text
This Article is shown as amended by the Data (Use and Access) Act 2025 (c. 18), among other instruments (see the annotations below) (commenced provisions as at 30 September 2026, ELI), as incorporated in the text in force on 30 September 2026 as published on legislation.gov.uk.
Annotations and footnotes
Textual Amendments
- F1 Ch. 8A inserted (19.6.2025 for specified purposes, 5.2.2026 in so far as not already in force) by Data (Use and Access) Act 2025 (c. 18), ss. 86(2), 142(1)(2)(h); S.I. 2026/82, reg. 2(n)
https://uk-gdpr.digiphile.law/article/article-84C.html
Text as at 17 September 2026.
This is an unofficial convenience version of the UK GDPR (Regulation (EU) 2016/679 as retained in UK law). It is presented “as is” without guarantee of accuracy, completeness or reliability. See the source text for the official version. This site was last updated in September 2026.