Scotland is building a health research system in which information produced during ordinary NHS care, such as hospital records, prescriptions, laboratory results and, increasingly, genomic information, can be linked and analysed for research. Private companies are being given clearer routes into that system, and in 2026 the Scottish Government began subsidising some of the costs for Scottish life-sciences businesses seeking to use public-sector data.
For most people, however, there is a more basic question underneath the language of research infrastructure, innovation and public benefit.
Can information about a person in Scotland be used for medical research when that person has never agreed to take part in the research?
Under defined circumstances, the answer is yes.
That does not mean researchers can freely obtain somebody’s named medical file, or that pharmaceutical companies are being handed identifiable copies of Scottish citizens’ DNA. Scotland has extensive legal, ethical and technical controls around health research, including Research Ethics Committees, NHS data controllers, Caldicott Guardians, the Public Benefit and Privacy Panel and secure environments known as Safe Havens.
But individual consent is not required for every form of secondary research using NHS information. Under more restricted circumstances, research can also use surplus diagnostic tissue from living patients without fresh individual consent. Even DNA analysis has a statutory research exception where strict conditions are met.
At the same time, Scotland possesses an extraordinary biological archive accumulated over generations: newborn heel-prick blood samples retained from babies born since 1965. Around three million cards are estimated to exist. Most of the older collection was retained before families were routinely told that the blood would be stored.
The separate pieces have existed for years. What is changing is the infrastructure connecting them.
Scotland’s first Human Genomic Medicine Strategy proposes national systems capable of storing, analysing and linking genomic information across NHS Scotland. The strategy envisages genomic information becoming part of national datasets, capable of linkage with wider health records and accessible for approved research through Research Data Scotland and Scotland’s Safe Haven network.
Research and innovation are not peripheral to the plan. They are being designed into it.
The NHS record that can become research data
Every encounter with NHS Scotland creates information.
A hospital admission may produce diagnosis and procedure codes. A blood test generates laboratory results. Prescriptions create prescribing records. Cancer diagnoses, maternity information, imaging, emergency attendances and deaths can become part of national or regional datasets.
These records were created primarily because somebody needed healthcare. They were not normally created because the patient had volunteered for a research project.
Scotland has nevertheless had a formal system for conducting research using such information for more than a decade.
The Scottish Government’s original 2015 Safe Haven charter was unusually explicit about its purpose. Its title referred to the handling of “unconsented data” from NHS patient records, and it described circumstances in which electronic health records could be processed, linked and analysed for research when obtaining individual patient consent was not practicable.
The system is designed so that researchers do not simply receive identifiable NHS records. Approved datasets are prepared inside controlled environments. Identifiers can be removed or replaced, access is restricted, projects are independently scrutinised and outputs are checked before they leave.
A revised Safe Haven charter published in 2025 retained the central model: personal health and social-care information can be accessed and processed within Trusted Research Environments under legal, ethical and security controls.
This is not an obscure theoretical power. It is already used.
A large Scottish liver-disease research project called SteatoSITE obtained clinical information through three regional Safe Havens covering 12 of Scotland’s 14 territorial health boards. The published study describes the information explicitly as “unconsented clinical data”.
The records included demographic information, diagnoses, procedures, routine blood results, prescribing information, cancer registrations and death records.
The researchers did not simply request names and hospital files. The project had approval through NHS Scotland’s Public Benefit and Privacy Panel and other governance routes, while linkage was carried out independently of the main research team.
The people represented in the dataset were not individually contacted and asked whether they wanted their medical histories included in SteatoSITE.
Research without individual consent is not the same thing as research without permission.
Permission can instead come through the legal and institutional system governing the data.
Why consent is not always required
The Scottish Government’s own Health and Social Care Data Strategy makes the position clear. It states that consent for the use of health and care information “will not always be required”.
The reason is that consent is not the only lawful basis under which personal information can be processed.
Health information receives particularly strong protection under data-protection law, but scientific research can still proceed under other legal conditions when the necessary safeguards and public-interest requirements are met.
This produces an important difference between two questions that are easily confused.
The first is whether somebody has consented to participate actively in a research study.
The second is whether consent is the legal basis allowing an organisation to process information about that person.
Those are not always the same.
A person asked to attend a research clinic, provide a new blood sample or participate in an experimental treatment will ordinarily encounter a direct consent process.
A person whose existing hospital history becomes one record among hundreds of thousands in an approved population study may never be contacted.
Scotland’s research infrastructure has been built partly because obtaining fresh consent from every person represented in decades of historical NHS data would make many population-level studies impossible.
The ethical substitute is intended to be governance: data minimisation, de-identification, independent scrutiny, secure access and a demonstrable research purpose.
Whether citizens regard that as equivalent to being asked is a different question.
Tissue removed during ordinary NHS care
The position becomes more unusual when the subject moves from digital information to material taken from the human body.
Hospitals hold enormous pathology archives. Tissue removed during biopsies, operations and other procedures can be retained because it is necessary for diagnosis and clinical records.
Some of that material eventually becomes surplus to diagnostic requirements.
NHS Research Scotland operates a national Biorepository Network covering human biological materials used in research. Its public information says that, alongside tissue provided by consenting research participants, the network can support researchers seeking access to “unconsented diagnostic surplus” held in NHS pathology and blood-science archives.
Commercial as well as non-commercial researchers can use the network.
Scotland’s law differs from the rest of the UK in an important respect.
The Human Tissue (Scotland) Act 2006 principally regulates tissue from deceased people. It does not establish the same statutory research framework for tissue from living people as the Human Tissue Act 2004 does in England, Wales and Northern Ireland.
Current Health Research Authority guidance states that research using tissue from living people in Scotland is governed instead through common law, NHS Research Scotland’s accreditation arrangements and other legislation.
For identifiable tissue from a living person, informed consent is legally required. Consent is also required where material has been anonymised but the project has not received Research Ethics Committee approval.
The consequence is significant: anonymised tissue from a living person can, in an appropriately approved research project, be used without obtaining fresh individual consent.
That is how material taken originally for clinical reasons can acquire a second life as research material.
The SteatoSITE project demonstrates the mechanism. It used archived liver tissue obtained through NHS Scotland’s biorepository infrastructure alongside linked NHS information.
The study participants had not all separately volunteered for that research project.
DNA has another set of rules
DNA is treated differently again.
Section 45 of the Human Tissue Act 2004 creates a UK-wide criminal offence connected with analysing DNA from bodily material without “qualifying consent”. Unlike most of that Act’s research provisions, Section 45 applies in Scotland.
It sounds absolute. It is not.
Schedule 4 creates excepted purposes.
The Human Tissue Authority’s current research guidance says DNA analysis can be undertaken without consent for research concerning disorders or the functioning of the human body when three conditions are satisfied: the material came from a living person; the researcher does not possess and is not likely to obtain information identifying that person; and the specific research project has approval from a recognised Research Ethics Committee.
The Authority gives the example of DNA being extracted from tissue biopsies belonging to living people. If the researcher cannot identify the patients and the project has recognised ethical approval, the absence of individual consent does not create the Section 45 offence.
The Human Tissue Authority nevertheless recommends obtaining consent where it is practical.
This is a narrow legal route, not a general permission to analyse anybody’s DNA.
But it means that the apparently straightforward statement that “nobody in Scotland can have their DNA researched without consent” is not correct.
Under certain tightly controlled circumstances, they can.
Three million blood spots
Scotland possesses another resource unlike almost anything else in its health system.
Since 1965, newborn babies have routinely undergone heel-prick blood testing for serious medical conditions. Drops of blood are placed on cards, tested and retained.
The archive is estimated to contain around three million cards.
For people born in Scotland across much of the second half of the twentieth century, a few drops of blood taken days after birth may therefore still exist.
The consent history is striking.
A Scottish Government review published in 2014 found that from 1965 until 2003, inclusion in the collection operated on “presumed” consent and parents were not told that the cards would be retained.
The report concluded that the majority of the collection was consequently being held without informed consent from the people concerned or, when they were children, their parents.
Modern practice is different.
NHS Inform now tells parents that leftover newborn blood samples must be stored for at least 12 months. Unless parents object, samples may be kept longer and used, with identifying details removed, for research, education and training.
Parents can tell their midwife that they do not want the card stored after the minimum period or used for research.
If NHS Scotland wants to use a sample in a way that is not anonymous, it says consent will be sought.
The historical archive presents a more difficult question because the overwhelming majority of older adults represented within it never made such a choice.
Researchers have already proved what the archive can do
Scotland’s newborn cards are not simply old pieces of paper.
Researchers have established that usable DNA can be recovered from them decades after collection.
A Scottish feasibility study published in 2022 examined whether the archive could support population research. The archive was described as approximately 900 boxes containing roughly three million cards.
Researchers found that sufficient information existed on most of the older cards to make linkage with NHS records technically possible.
They also showed that DNA could be recovered from blood spots stored for decades. In tests across cards dating from 1965 onwards, DNA of sufficient quality for sequencing was successfully recovered from most of those sampled.
The study went considerably further.
Researchers demonstrated that archived newborn DNA could reveal biological signals associated with exposures around birth, including epigenetic signatures corresponding with maternal smoking.
The possibility is remarkable: a sample collected shortly after someone’s birth could potentially be linked to decades of subsequent NHS history, allowing researchers to study relationships between very early biological conditions and diseases appearing much later in life.
The researchers described the archive as having the potential to create a population-level retrospective birth cohort extending back to 1965.
But there is an important limit.
The broader historical archive has been subject to a moratorium on general research access. The feasibility work that involved identifiable linkage used Generation Scotland volunteers who had consented to research.
Modern Scot found no subsequent Scottish Government publication announcing that the historical three-million-card archive has been opened to unrestricted general research.
The difference must not be blurred.
Scotland possesses the resource.
Researchers have demonstrated what it can do.
That does not mean millions of historical blood spots are currently being freely sequenced.
Some people have explicitly volunteered
There is another side to Scotland’s genomic research system that is straightforwardly consent-based.
The Scottish Health Research Register and Biobank, known as SHARE, allows adults to volunteer for research. Its ethics renewal in 2025 recorded a biobank containing material from around 243,000 consented surplus blood samples, including extracted genetic material.
Participants can authorise surplus blood remaining after routine NHS tests to be retained rather than discarded.
That material can then support approved research ranging from individual genetic variants to whole-genome analysis.
Generation Scotland operates on a similar volunteer basis.
Its biorepository currently records DNA from more than 35,000 participants. The cohort contains genotype, methylation, proteomic and other biological information, together with extensive health-record linkage.
Researchers can apply for access, including commercial companies. Commercial applications require contracts and undergo financial and reputational checks.
Participants therefore knowingly entered Generation Scotland.
They should not be grouped with patients whose routine NHS records enter secondary research without project-specific consent.
Scotland currently operates both models at once.
The commercial route is becoming clearer
The newest development is private-sector access.
In March 2026, Research Data Scotland published a new Operational Framework intended to make it easier and more consistent for companies to seek access to Scotland’s public-sector data for research.
The framework is expressly concerned with industry access to de-identified public-sector personal data.
Its starting condition is public benefit. Companies are expected to explain what benefit their proposed use will produce, what commercial interests are involved and how those interests are balanced against value to the public.
They are also expected to pay the costs associated with preparing and providing safe access to data.
The framework does not envisage handing companies a spreadsheet containing citizens’ medical records.
Individual-level research data is prepared inside a secure environment. Researchers work inside that environment, and the framework says row-level data cannot be removed.
Only approved outputs leave.
The economic purpose is nevertheless explicit.
The Scottish Government’s wider Unlocking the Value of Data programme was established because public bodies were receiving private-sector requests for access to personal data and lacked a consistent approach for deciding what should be allowed.
Its independent expert group concluded that private-sector use could produce public benefit but said economic value generated from Scottish public data should also be shared with the people of Scotland.
It proposed red lines against uses such as insurance, credit rating and marketing, and against projects whose purpose is overwhelmingly commercial rather than public.
The 2026 framework currently relies mainly on cost recovery while leaving the possibility of more developed benefit-sharing arrangements as commercial value emerges.
Government is now helping companies pay for access
In July 2026, Research Data Scotland opened another door.
Scottish life-sciences SMEs can apply for Private Sector Accelerator Awards providing up to £60,000 per project in waived data-preparation and analysis costs.
The money does not buy a company a copy of a citizen database. It pays organisations involved in preparing, curating, managing and linking the datasets required for an approved project.
A maximum of three projects is being funded under the scheme.
The stated purpose is to enable Scottish companies to turn public-sector health-data assets into new products and services.
That puts the issue beyond abstract discussions about whether health data might one day have economic value.
Scotland is actively constructing an economic development programme around controlled access to it.
Genomic medicine changes the scale
The most important development may still be ahead.
Scotland’s first Human Genomic Medicine Strategy, published in 2024 and running to 2029, describes the country’s existing genomic systems as fragmented.
There is currently no single national genomic medicine data return.
The strategy proposes changing that.
It calls for secure, scalable systems for storing and analysing large genomic datasets, including a national genomic variant repository. Genomic information is intended to be linked through Scotland’s Community Health Index and made available across health-board boundaries.
The longer-term plan is for standardised genomic information to become part of a national data return under Public Health Scotland.
That information could then be connected with other national datasets and registries.
Research Data Scotland and the Scottish Safe Haven Network are explicitly identified as potential gateways through which genomic information could be used for research, development and innovation.
The strategy repeatedly refers to collaboration among NHS Scotland, universities and industry.
It states that research and innovation should be “built in and facilitated by design”.
It also proposes developing consent models within genomic testing pathways that support research and innovation.
That last point will deserve close public scrutiny.
Genomic information is unlike an ordinary hospital code.
It can reveal inherited characteristics, disease susceptibility and biological relationships. It also inherently contains information about people who never supplied the sample: parents, siblings and children share portions of the same genetic inheritance.
The Scottish strategy itself recognises genomic information as identifiable information requiring particular care.
The decisions being made now about consent, linkage and future research access will therefore govern a resource substantially more sensitive than the administrative health datasets around which Scotland’s Safe Havens were originally built.
Scotland has no equivalent of England’s national opt-out
People in England can make a national data opt-out choice covering certain secondary uses of confidential patient information for research and planning.
That system does not apply in Scotland.
NHS England’s own guidance explicitly states that its national opt-out covers England and does not extend to information generated or processed in Scotland.
Scotland has had narrower mechanisms. The former SPIRE primary-care system allowed patients to flag an objection to certain identifiable GP extracts. SPIRE itself was decommissioned in 2023, although Public Health Scotland says the patient-exclusion code remains available in GP systems.
The replacement Primary Care Intelligence Service is currently focused on aggregate data, where individuals cannot be identified and therefore cannot individually be removed from an aggregate count.
But Scotland does not currently operate a single England-style national switch allowing somebody to say that all of their NHS information should be excluded from secondary research use.
People retain data-protection and confidentiality rights and can raise objections with NHS organisations.
Those rights are important, but they are not absolute.
NHS Scotland itself tells patients that personal information can be used for scientific research and other public-interest purposes under legal bases other than consent.
The potential dangers
The potential dangers in Scotland’s emerging genomic and health-data system do not begin with somebody deliberately misusing a database. They arise from the nature of the information itself and from what becomes possible when records that were once separate can be connected.
A hospital admission on its own reveals something about a person. A prescription history reveals more. Laboratory results, imaging, cancer registrations, maternity records and decades of diagnoses reveal still more. Add genomic information and biological samples, then connect those records through Scotland’s Community Health Index, and the resulting resource can describe a person with a degree of detail that would have been impossible when many of the individual records were originally created.
That is precisely what gives linked health data its scientific value. It is also what increases the consequences if the information is used for purposes people did not expect, if access controls fail, or if seemingly de-identified information can be connected back to individuals.
Genomic information presents a particular problem because anonymity becomes much harder to guarantee. Scotland’s own Genomic Medicine Strategy treats genomic information as identifiable information and acknowledges that its value comes partly from linking it with other genomic and clinical datasets. A sufficiently detailed genetic profile is not comparable with an anonymous spreadsheet row. It can itself distinguish one person from another.
DNA is also permanent. A compromised password can be replaced. A genome cannot.
And genomic information does not concern only the person whose sample was tested. Biological relatives share portions of the same inheritance. A finding about one person’s genome may reveal information about parents, siblings or children who never provided a sample and never entered the research project. The expansion of genomic medicine therefore creates privacy questions extending beyond the individual patient on whom a test was performed.
Scotland’s strategy recognises another difficulty: it may not be possible to know at the time of testing everything that genomic information will eventually reveal. Scientific understanding changes. A sequence generated for one clinical purpose today could contain information that acquires entirely different significance years later. The Scottish Government itself acknowledges that the future implications of genomic information can be difficult to predict, complicating the idea of fully informed consent.
That problem becomes larger when information is retained for long periods. Consent given for one class of research may precede technologies that did not exist when the person agreed. Artificial intelligence can identify relationships across very large datasets that researchers working manually could never reasonably discover. New analytical techniques can therefore increase the informational value of old records without anything new being collected from the patient.
The historical newborn blood-spot archive illustrates the problem particularly clearly. Millions of Scottish samples have survived from a period when parents were not routinely told that the cards would be retained. Scientific advances have since demonstrated that useful DNA can be recovered from cards stored for decades and potentially linked to later NHS information. The research moratorium surrounding the wider historical archive currently limits what can be done, but the scientific capability now exists in a form that could not have been explained to parents whose babies were screened in the 1960s or 1970s.
There is also the risk of what is sometimes called function creep: information collected for one legitimate purpose gradually becoming useful for others.
A genomic test might begin as part of diagnosis. Its result may subsequently contribute to a national genomic repository. The resulting information may support health-service planning, research, drug development or artificial-intelligence analysis. Each individual step may have a lawful justification and its own safeguards. The cumulative effect can nevertheless be very different from the purpose for which the citizen originally encountered the NHS.
Scotland’s genomic strategy itself acknowledges that the boundary between clinical care and research is becoming less clear, particularly where research increasingly forms part of routine genomic medicine. It is therefore developing consent models intended not only to support clinical testing but also to facilitate research, development and innovation.
Commercial involvement introduces another set of questions.
Companies may discover medicines, diagnostics, algorithms or other intellectual property by analysing publicly supported Scottish health resources. Scotland’s emerging private-sector framework requires public benefit and controlled access, while government advisers have argued that economic value generated from public data should be shared with the public sector and the people of Scotland.
But there is not yet one simple national formula under which a citizen can see how much commercial value was generated from information ultimately derived from people like them, how much the company retained and what returned to Scotland.
This produces a potential imbalance. The individual may contribute the biological information without receiving a direct financial interest in whatever is subsequently created from it. NHS Scotland, universities and other public institutions may have spent decades generating, maintaining and linking the underlying records. A private organisation may then develop commercially valuable intellectual property using an approved research environment. Cost-recovery charges for access do not necessarily correspond to the eventual value of what is discovered.
The Scottish Government’s own work on private-sector data access has recognised this issue and considered benefit-sharing mechanisms, including questions around intellectual property and financial return. That policy work exists because access to health information can create economic value far beyond the administrative cost of preparing the dataset.
There are risks even where no commercial organisation is involved.
Large linked datasets increase the consequences of a security failure. Scotland’s proposed genomic infrastructure is intended to make information available across organisational boundaries while supporting national analysis and research. That requires more systems, more authorised users, more technical connections and more decisions about access. Secure research environments are designed to reduce those risks, but no digital architecture can make the possibility of error, inappropriate access or cyberattack disappear altogether.
The sensitivity of genomic information makes the potential consequences unusually long-lived. A medical-record breach may reveal a past diagnosis. A genomic-data breach could expose information relevant to health risks throughout someone’s lifetime and, potentially, information relevant to relatives as well.
The increasing use of artificial intelligence introduces a different risk: conclusions may be produced from combinations of information that no human researcher explicitly sought.
Algorithms can discover correlations across genetics, diagnoses, prescriptions, geography and other characteristics. Those correlations may prove medically useful. They can also reproduce biases in the population from which the data was drawn.
Scotland’s genomic strategy itself warns about health-data inequalities. Populations that are poorly represented in genomic datasets may receive less accurate predictions or fewer benefits from precision medicine. Conversely, communities that are heavily represented can become disproportionately visible to research systems.
There is also the possibility of erroneous inference. Medical records are not perfect descriptions of human beings. Coding mistakes occur. Diagnoses change. Prescriptions do not prove that medicines were taken. A laboratory result can be abnormal for temporary reasons. When millions of such entries are linked together and analysed computationally, errors can become part of the evidence from which conclusions are drawn.
Genomic predictions can present a related problem. Genetic susceptibility is not the same as certainty. A variant associated statistically with increased risk does not mean that an individual will develop the disease. As genomic information becomes more widely available across healthcare, maintaining the difference between probability and diagnosis becomes important.
Genetic discrimination is another recognised concern. Scotland’s Genomic Medicine Strategy specifically identifies it as one of the possible unintended consequences associated with genomic information.
Current Scottish data-access proposals place restrictions around uses such as insurance, credit rating and marketing, and there is no evidence that Scottish genomic databases are presently being opened for those purposes. The concern is instead about the future value of information that could potentially reveal predisposition to illness, longevity or inherited conditions. The existence of safeguards today does not remove the need to decide where permanent boundaries should sit as the technology develops.
Public trust may ultimately be one of the system’s most valuable protections, and one of the easiest to lose.
Research Data Scotland, NHS Scotland and the Scottish Government repeatedly emphasise public benefit, secure access and transparency. Those protections depend upon citizens believing that the institutions holding their information will use it in ways broadly consistent with what people reasonably expect.
That makes transparency more than a communications exercise.
A citizen who discovers after the event that their information could legally have been used in research without individual permission may react differently from a citizen who understood that possibility beforehand, even if exactly the same lawful safeguards operated in both cases.
The same is true of commercial research. Telling people that companies cannot simply download their NHS records is important. So is telling them that approved company researchers may nevertheless be permitted to analyse de-identified information derived from those records inside secure environments.
Scotland’s system contains significant safeguards: independent ethics review, privacy assessment, Caldicott oversight, data controllers, Trusted Research Environments, disclosure checking, contractual controls and special legal protections surrounding health and genetic information.
Those controls substantially reduce risk.
They cannot resolve the underlying policy question of how much secondary use of a person’s biological and medical history should be permitted without that person making an individual decision each time.
That question becomes more difficult as Scotland moves from relatively conventional health statistics towards national genomic infrastructure capable of connecting DNA, clinical histories and increasingly powerful analytical systems.
The greater the scientific value created by linking those resources, the greater the consequences of getting the boundaries wrong.
Sources
Scottish Government, Genomic Medicine Strategy 2024 to 2029, 19 April 2024. Scottish Government genomic strategy
Scottish Government, Health and Social Care: Data Strategy, 22 February 2023. Scottish health and social care data strategy
Scottish Government, Charter for Safe Havens in Scotland: Handling Unconsented Data from NHS Patient Records to Support Research and Statistics, 16 November 2015. 2015 Safe Havens charter
Scottish Government, Safe Havens: Charter, 27 March 2025. 2025 Safe Havens charter
Research Data Scotland, Private Sector Access to Public Sector Data: Operational Framework for Research Data Access, 23 March 2026. Private-sector data access framework
Research Data Scotland, Private Sector Accelerator Awards, 2026. Private Sector Accelerator Awards
Scottish Government, Unlocking the Value of Data — Independent Expert Group: Final Report, 31 August 2023. Unlocking the Value of Data final report
NHS Research Scotland, The Biorepository Network, current guidance. NHS Research Scotland Biorepository Network
Health Research Authority, Compliance with National Legislation Regarding Human Tissue, updated 28 April 2026. HRA human tissue guidance
Human Tissue Authority, Code E: Research — Consent and DNA Analysis, current guidance. Human Tissue Authority research code
Human Tissue Act 2004, Section 45 and Schedule 4. Human Tissue Act 2004
Fallowfield et al., An Integrated Gene-to-Outcome Multimodal Database for Metabolic Dysfunction-Associated Steatotic Liver Disease, Nature Medicine, 2023. SteatoSITE study
Scottish Government, Guthrie Cards in Scotland: Ethical, Legal and Social Issues, 13 January 2014. Scottish Government Guthrie card review
Cunningham-Burley et al., Feasibility and Ethics of Using Data from the Scottish Newborn Blood Spot Archive for Research, Communications Medicine, 6 October 2022. Scottish newborn blood-spot feasibility study
NHS Inform, Blood Spot Tests in Scotland, updated 29 July 2026. NHS Inform newborn blood-spot guidance
Health Research Authority, SHARE: Scottish Health Research Register and Biobank — 2025 Renewal, favourable opinion 26 February 2025. SHARE ethics renewal
Generation Scotland, About Samples, 3 July 2025; and Access Policy, 2025. Generation Scotland samples Generation Scotland access policy
NHS England, National Data Opt-Out: Geographical Coverage, current guidance. National Data Opt-Out guidance
Public Health Scotland, Primary Care Intelligence Service — Information About PCIS, current guidance. Public Health Scotland PCIS information
NHS Inform, How the NHS Handles Your Personal Health Information, current guidance. NHS Scotland health-information guidance
Scottish Government, Genomic Medicine Strategy 2024 to 2029 — Ethical and Legal Frameworks, 19 April 2024. Scottish Government genomic medicine strategy
Scottish Government, Genomic Medicine Strategy 2024 to 2029 — Data and Digital Infrastructure, 19 April 2024. Scottish Government genomic data infrastructure
Scottish Government, Genomic Medicine Strategy 2024 to 2029 — Genomic Data Returns and Building a Robust Evidence Base, 19 April 2024. Scottish Government genomic data returns
Scottish Government, Genomic Medicine Strategy 2024 to 2029 — Research, Development and Innovation, 19 April 2024. Scottish Government genomic research and innovation
Scottish Government, Guthrie Cards in Scotland: Ethical, Legal and Social Issues, 13 January 2014. Scottish Government Guthrie card review
Information Commissioner’s Office, What is Special Category Data?, current guidance. ICO guidance on genetic and health information
Research Data Scotland, Private Sector Access to Public Sector Data: Operational Framework for Research Data Access, March 2026. Private-sector data access framework
