Research Accreditation Panel minutes: 29 June 2026

Published:

Attendees

Members  

  • Paul Boyle (Chair)
  • Ann Berrington (Independent Member)
  • Mark Brewin (HM Revenue & Customs)
  • Michael Chapman (NHS England)
  • Tricia Dodd (Independent Member)
  • Andrew Garrett (Independent Member)
  • Mike Jones (Department for Work & Pensions)
  • Geraint Jowers (HM Revenue & Customs)
  • Alistair McAlpine (Scottish Government)
  • Alexander Singleton (Independent Member)

Advisers

  • Keith Nicholson (Security Advisor, Office for National Statistics)
  • Nicola Shearman (Data Protection Officer, UK Statistics Authority)

Other attendees  

  • Tina Beeson (Item 05)
  • Colin Farrell (Item 02)
  • Natasha Kong (Item 03)
  • Rhys Nadin (Item 02)
  • Roland Potts (Item 05)
  • John Whittlestone (Item 04)

Secretariat  

  • Daniel Beck (UK Statistics Authority)
  • Lewis Hopcroft (UK Statistics Authority)
  • Stephanie Jacobs (UK Statistics Authority)
  • Wilfred Thorne (UK Statistics Authority)

Apologies  

  • Sue Bateman (Department for Environment, Food & Rural Affairs) 
  • Martin Bowyer (Central Digital and Data Office)
  • Chris Dibben (Independent Member)
  • Emma Gordon (Administrative Data Research UK)
  • Roger Halliday (Independent Member)
  • Sarah Henry (Office for National Statistics)
  • Stephanie Howarth (Welsh Government)
  • Philip Wales (Northern Ireland Statistics and Research Agency) 

Minutes

1. Minute and matters arising from the previous meeting

  1. Members were welcomed to the meeting and apologies were received from Sue Bateman, Martin Bowyer, Chris Dibben, Emma Gordon, Roger Halliday Sarah Henry, Stephanie Howarth and Philip Wales.
  2. Panel members were informed that a summary of the March Strategic Workshop was included in the paper pack for information only, and that it will not be published on the UK Statistics Authority’s (the Authority) website.
  3. The Chair invited panel members to approve the amended version of the Research Accreditation Panel’s (RAP) terms of reference, incorporating feedback received from the previous meeting. The amended version of the terms of reference were approved.
  4. Panel members were reminded that those representing government departments can nominate deputies to attend future meetings in their absence, subject to permission granted by the Chair.

2. Learning from the UK Biobank Incident: How DEA Accreditation Mitigates Disclosure Risk

  1. Colin Farrell and Rhys Nadin introduced a paper providing RAP with assurance that the type of failure observed in the UK Biobank incident is specifically addressed by the DEA accreditation framework. The paper explained how DEA accreditation mitigates this class of risk through a combination of controls, while recognising that the effectiveness of those controls depends on their consistent application to data across the Trusted Research Environment (TRE).
  2. RAP were invited to note the distinction between UK Biobank’s access model and DEA accredited processing environment requirements and consider the effectiveness of the DEA accreditation framework in preventing inappropriate data disclosure.
  3. The Authority recommended publishing a blog outlining how DEA accreditation keeps data secure in DEA accredited processing environments. The blog would follow Administrative Data Research (ADR) UK’s recent publication on how they ensure the TREs they fund are kept secure. However, it would cover all DEA accredited processing environments and not just those funded by ADR UK.
  4. RAP were supportive of publishing a new blog and recommended emphasis on the following points to provide necessary reassurance to the wider research community to maintain confidence in the DEA accreditation framework and accredited processing environments:
    1. why independent accreditation oversight is important for providing a more robust and effective process to ensure safer access to data;
    2. how transparency with data use processes helps to maintain trust with the public and data owning organisations; and
    3. how accreditation under the DEA and independent oversight by the Research Accreditation Panel supports research in the public good.

Action:

The Authority to produce a draft blog on how DEA accreditation ensures DEA accredited processing environments are kept secure by August and share this with RAP prior to publication.

3. ADR UK and UKSA Task and Finish Group Update – End of Pilot Round Up and Next Steps

  1. Daniel Beck and Natasha Kong provided an update on the work of ADR UK’s Task and Finish Group relating to the research project application pilot (the Pilot), providing RAP with feedback from Trusted Research Environments (TREs) and informing on the group’s next steps.
  2. RAP were invited to review findings from the Pilot evaluation and share views on the next steps for the group. The findings indicated that the overall response from TREs was positive with many efficiencies made and highlighted minor suggested improvements which the Authority will seek to address in the short-term.
  3. RAP discussed the findings and considered where the Task and Finish Group could focus their time to make future improvements within the data access journey for researchers. Panel members were informed of plans to continue ADR UK’s Task and Finish Group with a focus on reducing duplicative requests for information between data owner forms and other application forms to access DEA data.
  4. RAP were supportive of the progress made and recommended the Authority provide panel members with an update on the Task and Finish Groups plans for improving access to data for researchers at a future RAP meeting, including the rationale for the prioritisation of improvements based on their impact.

Action:

The Authority to provide panel members with an update on the Task and Finish Groups overall plans for improving access to data for researchers at a future RAP meeting, including the rationale for the prioritisation of improvements based on their impact.

4. Presentation: Improvements to PASS and the Secure Research Service

  1. John Whittlestone presented to the panel on recent improvements to the Project Accreditation Service for the Secure Research Service (PASS), metrics detailing the impact of PASS on processing project applications, feedback from researchers, and detail future plans for the platform.
  2. RAP acknowledged the improvements made to PASS and discussed the feedback provided by researchers and the benefits realised for a greater understanding of the progress made by the Secure Research Service.

5. Integrated Data Service – Removal of Accreditation

  1. Roland Potts provided the panel with a paper seeking RAP confirmation on the need to remove Digital Economy Act (DEA) 2017 accreditation to provision data from the Office for National Statistics’ (ONS) Integrated Data Service (IDS) and to support continued projects under the Statistics and Registration Services 2007 (SRSA) ‘approved researcher’ gateway on a limited, exceptions basis.
  2. RAP were invited to approve the following proposals:
    1. note the closure of the IDS’ front door to new research requests on 14th July 2025;
    2. agree that DEA accreditation will need to be withdrawn given this change in the Service provision, and therefore accreditation for ONS to provision data via the IDS as a Trusted Research Environment under the DEA will be removed by the next review (29 September 2026); 
    3. agree that, in order for them to continue, existing DEA projects must pivot to being provisioned under ONS’ legal powers (S.394)i) SRSA) to mitigate disruption caused by a change in service provision; 
    4. agree that RAP will review and approve new project requests for this platform under S.39 4)i) on a limited, exceptional basis, and subject to continued assurance being provided around the security and capability controls governing the platform and service; and 
    5. note that ONS will continue to maintain DEA accreditation to prepare data (via its Data Analysis Platform (DAP)) and, separately, to provision data (via the Secure Research Service (SRS)). 
  3. RAP discussed whether it would be appropriate to review and approve research projects under S39 SRSA submitted from a non-DEA accredited processing environment. The Authority clarified that RAP’s role would move to being purely advisory, but with RAP still being able to ask for evidence to inform their discussions.
  4. The Authority emphasised that while GCP AP would not be formally accredited under the DEA, they would be required to align with existing assurance processes and standards with a report produced on their compliance with security and capability standards. Any advice provided by RAP would be informed by this assessment and supporting report.
  5. RAP approved the proposals by IDS, agreeing with the withdrawal of their existing DEA accreditation and the plan to continue to provide oversight of existing projects under S39 SRSA. It was agreed that further considerations are required to agree to an ongoing role for reviewing and approving research projects on an exceptional basis, including consideration of how disagreements between RAP and the Authority are resolved.

Action:

The Authority to provide RAP with reassurances required for agreement to continue oversight of research projects under S39 SRSA on an exceptional basis.

Action:

The Authority to review the newly approved Terms of Reference to ensure they reflect RAP’s advisory role on these projects.

6. For Information: Research Accreditation Criteria Update

  1. Wilfred Thorne provided RAP with an update on the review of the Research Accreditation Criteria, informing on the progress of the formal consultation and the timelines for next steps.
  2. RAP were informed that the Authority aim to go live with the consultation in July following recent agreement from the permanent secretary to proceed. The consultation will run for 12 weeks.

7. Any other business

  1. The Chair informed panel members they are required to complete the confidentiality agreement provided in the paper pack, and return this to the Authority via e-mail.
  2. The Chair informed panel members of NISRA Census’ intention to move their full reaccreditation under the DEA forward by one year to 2029 in alignment with NISRA RSU. This is to relieve any pressure on teams caused by the Northern Ireland Census in 2031. RAP approved this and there were no objections.
  3. The Authority informed panel members that a select number of panel members will be required to participate in regularly reviewing and accrediting annual processor accreditation reviews via Confluence. This process would be similar to the existing process for reviewing research project applications.
  4. The Chair raised an ongoing application being supported by the secretariat for a milestone project. This application has undergone substantial revisions and is likely to be discussed by RAP in more detail at a future meeting.
  5. RAP discussed processing environment cost models and considered whether further information is required to gain a better understanding of potential costs.  The Secretariat agreed to engage with the PR UK advisory board and ADR UK and produce a report for a future RAP meeting.
  6. The next RAP meeting is scheduled for 29 September 2026, which will take place virtually via Microsoft Teams.

Action:

Authority to engage with research organisations to understand whether any information has been compiled on cost models of TREs and present findings to RAP at a future meeting.