In the UK the duty of confidentiality is not enshrined in statute but is Judge made law, the product of many cases brought before the Courts of England & Wales.

A duty of confidentiality can be established in situations where information is passed, in confidence, to the confidant (the receiver of the information).

Any duty that exists is tempered by statute, either to provide an exception to the rule or to limit it in some way. Some Statutes, such as, for example, the Data Protection Act 2018 and GDPR (the General Data Protection Regulation) amplify the duty not to disclose certain types of information appertaining to individual persons and known generically as “data” without the person’s express consent whilst others, such as the The Freedom of Information Act 2000 over rides the duty to keep confidential information or data, where the information or data has been shared or provided to public bodies such as Universities, though there are exceptions to the duty to disclose contained in that Act.

As a matter of practice:

• Research participants should be informed about how far they will be afforded anonymity and confidentiality.
• Guarantees of confidentiality and anonymity given to research participants must be honoured, unless there are clear and overriding reasons to do otherwise.
• Researchers should not breach the 'duty of confidentiality' and not pass on identifiable data to third parties without participants' consent.

However, research data given in confidence does not enjoy legal privilege and may be liable to subpoena by a court.

• In relevant circumstances research participants should be made aware of this fact.
• Researchers (including students and those undertaking work on behalf of the University) should guard against giving unrealistic guarantees of confidentiality and anonymity and be aware that in a legal challenge, it may be necessary to inform research participants of obligations which require the Researcher to disclose the confidential information to a Court or to the Police or other authorised bodies, which may make it impossible for a Researcher or anyone else not to disclose it.

Further information

NHS - Codes of practice for handling information in health and care