Confidentiality Advisory Group (CAG) Guidance#
Last modified: 27 Aug 2026
Introduction to CAG applications:#
The Confidentiality Advisory Group (CAG) advises on both research and non-research uses of confidential patient information without consent.
Testing the acceptability of using patient identifiable data for linkage without participant consent:
CAG can recommend that an Longitudinal Population Studies (LPS) can utilise Section 251 where consent is not practicable and frequently on the condition that:
LPS contact their own Patient and Public Involvement and Engagement (PPIE) activity to understand and accommodate participant expectations.
LPS do all that is practical to contact participants, providing fair processing information about the data use and a means to opt-out.
LPS send regular updates about how health records are used and remind participants how to opt-out.
‘NHS National Data Opt Outs’ are honoured – this is a national scheme in England which allows members of the public to stop their data being used for research unless consent is in place.
Research applications should be prepared on the Integrated Research Application System (IRAS).
The Health Research Authority (HRA) has created a CAG pre-application checklist to assist you in deciding whether your study ought to pursue applying to process information without consent. For information on how to prepare for the application and documents that will be required, please see HRA guidance.
How long does a CAG application take to be approved
The Confidentiality Advisory Group state that valid applications, received by the relevant submission dates, can expect to receive an approval decision within a maximum of 60 working days.
How to answer UK LLC specific CAG questions#
Is any processing of identifiable information taking place in Wales? Yes – via NHS Digital Health & Care Wales for data linkage.
What attachments should I include about UK LLC’s processing?
Include a link to our data flow diagrams on your partnering page
Include a link to UK LLC’s approved protocol
What UK LLC specific text can I use to support my application?#
Aims of UK LLC:
The UK LLC is a ‘Trusted Research Environment’ (otherwise known as a ‘Secure Data Environment’), designed to link study data from major inter-disciplinary UK LPS participants, to a wide range of participants’ health and non-health records and other sources. The Trusted Research Environment is a set of technical and governance safeguards designed to protect data during research. Only de-identified data is held in the UK LLC, researchers can access data in the TRE but cannot remove it or take copies, and all users are thoroughly checked before access is provided under contract. The UK LLC TRE has public contributors involved across its design and operations, and is subject to independent audits by ethics panels, security experts and government auditors. The UK LLC has adopted the Five Safe’s principles:
Safe data: data are de-identified to protect any confidentiality concerns.
Safe projects: research projects are approved by UK LLC and each LPS and must be for the public good.
Safe people: researchers using the UK LLC are trained and authorised to use data safely.
Safe settings: the UK LLC TRE environment prevents unauthorised use.
Safe outputs: screened and approved outputs that are non-disclosive.
The integrated data, infrastructure and accompanying governance aspects is collectively known as the UK LLC.
The primary aims of the UK LLC are:
to centrally facilitate the research programmes of all contributing studies (and those seeking to join). This includes studies which already operate as generic research databases and those which have a defined research theme which has been communicated with participants; and,
to provide an efficient access route to approved research users via mechanisms which uphold participants’ rights and expectations.
Template text to be used in CAG application:
A request to join the UK Longitudinal Linkage Collaboration (UK LLC, NHS Haydock Committee; IRAS: 290946, REC ref: 20/NW/0446), by providing de-identified [x] data into a Trusted Research Environment managed by the UK LLC at the University of Bristol. The UK LLC is a national initiative initially funded by the HM Treasury. Recently it was funded for a further 5 years by UKRI, to support longitudinal research by collating information from cohort studies across the UK, including research study data and electronic health records. [Study name] would join the UK LLC by depositing relevant de-identified study data from the [x] research database into the University of Bristol’s Trusted Research Environment (hosted by the University of Swansea, Data Processor, comprising a UKSeRP model (UK Secure e-Research Platform), ISO27001 accredited). This information will be sent alongside a study ID in order to enable future linkages.
It is at the discretion of [x study] to decide what data to deposit, and data will be deposited on a project-by-project basis. These data transfers will be governed by a Data Deposit Contract between the University of [X] (Data Owners) and the University of Bristol (Data Controllers).
In a separate transfer, the [x study] admin team will send participant identifiers to Digital Health and Care Wales (DHCW) to facilitate the linkage of electronic health records. This data will be linked through the NHS’ trusted partners, and relevant de-identified data (linked with study ID) from these NHS partners will be securely transferred back to the UKSeRP where the study ID will be encrypted, and this data deposited into the UK LLC Trusted Research Environment.
All data requests to the UK LLC that involve [x study] data will be reviewed by the [Name of group]. Any data shared with researchers will be re-encrypted and in de-identified form and only accessed within the UK LLC TRE. All outputs from the TRE are checked for disclosure risk and will be population level statistical information. For data held in the UK LLC, consent status and data refreshes take place on a quarterly basis, with removals conducted at these times. The UK LLC staff will implement any changes of status and will make the data of objecting participants unavailable in the main integrated data repository. De-identified data that has already been shared with researchers cannot be recalled regardless of change of consent status (as is standard with research studies), and archive copies of all projects that have resulted in published manuscripts will be retained for scientific challenge.
>Justification:
Through working with UK Longitudinal Linkage Collaboration (UK LLC) as a Data Processor, x data can be used in combination with data from other UK cohort studies to gain a more in depth understanding of health in the UK. This novel and heterogenous pooled sample provides a unique opportunity for cross-cohort analyses to examine health outcomes across different ages, groups and times. This collaboration will enhance the research value and use of study as a scientific resource, and not being part of the UK LLC will slow this work. Researchers will only be approved to access UK LLC data if their proposed research is in the public interest
What fair processing evidence will I need to submit?#
Fair processing updates:
It is a requirement of the Regulations that an application cannot be inconsistent with the principles of the General Data Protection Regulation and Data Protection Act 2018 (GDPR/DPA). The first principle of the DPA requires that reasonable efforts are made to inform data subjects of the use of their data.
UK LLC guidance to update participant information materials (websites, leaflets, posters etc.) can be found on the UK LLC Resource Hub.
You can submit these UK LLC specific fair processing materials as part of your CAG application.