Accessing secure research data as an accredited researcher

On 16 March 2020, the UK government updated their advice in relation to the coronavirus (COVID-19), advising against all non-essential social contact and travel.

We continue to follow government and Public Health England's guidelines on social distancing, with Office for National Statistics (ONS) staff now working from home.

We know that many people rely on our services for research to support rapid policy analysis. During these challenging times, we remain committed to keeping the Secure Research Service (SRS) running throughout these restrictions, but there will be an inevitable impact on how we operate and who can access the service.

All SRS safe setting rooms remain closed until further notice.

Continuing to support research

We want to continue to support research, particularly that which is important to the day-to-day operation of the government, but we also need to ensure we meet our legal obligation to protect the confidentiality of data subjects.

We have put a range of measures in place to ensure the service can continue to be supported by Office for National Statistics (ONS) staff, and we are working to limit the impact on your work.

We have been asked whether it is possible for researchers to access the SRS from home, to enable their work to continue. This is not usually permitted because of data security concerns.

This is an extraordinary situation, and we have been working closely with our suppliers, security experts and ONS senior leaders to agree a policy to temporarily modify our approach to remote access while restrictions on travel are in place.

It has been agreed that some work can be permitted but that this should be prioritised according to the importance of the research, and not an automatic extension of access for all.

This will help us manage the change while continuing to ensure that we protect data and demonstrate that our controls are robust. In making this decision, we have consulted with Administrative Data Research UK (ADR-UK) and the Department for Education (DfE), who support an increasing range of research in the SRS. We have also consulted with the UK Data Service (UKDS), who also provide secure access to some ONS data. This ensures that our approach is supported and consistent.

Application Processing times

Work to assist the response to COVID-19 is currently taking priority for ONS. With reduced capacity to deliver our usual service, support to live projects will take priority over any new projects, unless the project is related to COVID-19. This means that it is taking longer than normal for other project applications to be processed by ONS.

Please allow additional time for research applications to use the SRS to be processed. The submission dates for each Research Accreditation Panel meeting do not currently reflect how quickly an application can be presented to the panel by ONS.

Assured Organisational Connectivity agreement

Researchers based in organisations that have an Assured Organisational Connectivity (AOC) agreement in place with us are already able to access the SRS from their employers' offices, and this arrangement has worked well since its introduction.

To help limit the impact of current travel restrictions on research, it has been agreed that:

• researchers in organisations with existing remote connectivity can continue to work from their offices as normal

• limited home working will be permitted; in the first instance, this will be where researchers work for organisations with an AOC agreement in place and the research is important to the current operation of the government and public services

• access to projects from home will be subject to approval from the ONS and data owners; this will be decided on a case-by-case basis

• access must be from a machine provided by the organisation the researcher works for, connecting to the SRS through their corporate virtual private network (VPN)

• all researchers accessing the SRS from home will need to read and sign an extended Security Operations Procedures (SyOps) document

To be considered for approval to access the SRS from home, you will need to request an application form by email from research.support@ons.gov.uk. You will then need to complete and return the form by email to research.support@ons.gov.uk. The form will request the following information:

• details of the project(s) you wish to access

• which members of the project team require access

• an explanation of the importance of this work to the UK government, and the impact of delays on its completion

• confirmation that the researchers will access the SRS from home using a machine provided by the organisation, with a connection to the SRS through their corporate VPN and that their organisation has or will have an AOC in place

Additionally, applicants should provide information about their research project against one (or both) of the criteria in (A) and provide information for the criteria in (B):

A. Purpose of project

• Is the research project important to the current operation of the government and public services? This includes research to support, inform or evaluate the government's (or its partners') COVID-19 response activity.

• Is there another reason why it is important that work on this project continues given the current COVID-19 situation and related restrictions?

B. Urgency and timescales

• What is the level of urgency and the timescales for delivery or analysis and outputs for the research project?

• What would be the impact of delays to this project?

Each request will be considered in discussion with data owners and experts from across the ONS, and you will be informed of the decision as soon as possible. Requests will be reviewed and responded to within two working days. Where agreed, you will then be advised on how to access the SRS from home.

If the current restrictions are extended, it may be possible to extend home working for additional important research. We will keep this under review as government advice changes and once the first tranche of such connections have been shown to work effectively and securely. Any such access will continue to require that your organisation has an AOC agreement in place.

If you work for an organisation with remote access through a legacy agreement but that has not yet finalised the transition to an AOC agreement, this will need to be completed before home access will be permitted. In this circumstance, please email srs.connectivity@ons.gov.uk for further guidance on AOC agreements and completing this transition.

No Assured Organisational Connectivity agreement?

If you work in an organisation with no remote connectivity to the SRS, you can apply for an AOC agreement. However, please be aware that this may take longer to arrange with the current restrictions in place and applications will be prioritised in accordance with the importance of your research to the government.

To apply for an AOC agreement, please email srs.connectivity@ons.gov.uk. You will be sent the appropriate application forms and guidance.

Once again, each request will be assessed on a case-by-case basis.

We will continue to monitor remote use of the SRS. Any user attempting to access the SRS remotely without explicit approval will be in breach of our security policy. This will lead to action that could remove access for the individual and their organisation.

We recognise that this policy will not allow all our users to continue to use the service within the current restrictions and that some research will be delayed as a consequence. However, it is essential that we do not create an unacceptable risk to data confidentiality.

We will continue to review the policy throughout this emergency period and keep you updated regularly through what we all hope will be a short interruption to our usual work. If you have any other questions, please email research.support@ons.gov.uk.

The Office for National Statistics Secure Research Service (SRS) gives accredited or approved researchers secure access to de-identified, unpublished data in order to work on research projects for the public good. We have been accredited as a Digital Economy Act (DEA) 2017 processor by the UK Statistics Authority for the preparation and provision of data for research purposes.

The SRS provides a safe setting, as part of the Five Safes Framework to protect data confidentiality. The framework is a set of principles adopted by a range of secure labs, including the ONS.

Most datasets are available to access through remote access to the SRS. In some instances, the data can only be accessed from an approved safe setting. Our data catalogue (XLS, 29.6KB) lists all available datasets and any associated access restrictions.

For safe use of secure data, the Secure Research Service (SRS) uses the Five Safes Framework. This is a set of principles adopted by a range of secure labs. These protocols provide complete assurance for data owners. The Five Safes are:

Safe People

Trained and accredited researchers are trusted to use data appropriately.

Safe Projects

Data are only used for valuable, ethical research that delivers clear public benefits.

Safe Settings

Access to data is only possible using our secure technology systems.

Safe Outputs

All research outputs are checked to ensure they cannot identify data subjects.

Safe Data

Researchers can only use data that have been de-identified.

There are four ways in which a researcher can be associated with a research project that accesses data in the Secure Research Service (SRS):

• Accredited researcher (full or provisional) under the Digital Economy Act 2017 (DEA) – this provides access to the data in the SRS to carry out analysis and produce outputs, and is the most common gateway for access.

• ONS approved researcher (full or provisional) under the Statistics and Registration Service Act 2007 (SRSA) – this provides access to the data in the SRS to carry out analysis and produce outputs.

• Peer reviewer accredited under the DEA – this provides access to the data in the SRS to carry out analysis and produce outputs with the aim of validating or replicating previous analysis.

• Peer reviewer under the Statistics and Registration Service Act 2007 (SRSA) – this provides access to view cleared outputs only but with no access to data within the SRS; this role does not require accreditation, but a short online training course must be completed by the researcher if they are to be included on an SRS research project.

A provisional accredited researcher may request access to the secure data in the SRS under the supervision of an accredited researcher. This role suits researchers without the appropriate experience or qualifications for accredited researcher status and is valid for one year.

Most access to data in the Secure Research Service (SRS) will be by researchers accredited under the Digital Economy Act 2017 (DEA). The UK Statistics Authority has published further information on the criteria to be met in a Research Code of Practice and Accreditation criteria. Researchers can apply for accreditation through the Research Accreditation Service (RAS).

Full accredited researcher status is valid for five years. Provisional accredited researcher status is valid for one year.

A complete list of accredited researchers will be published on the UK Statistics Authority website to ensure transparency of access to research data under the DEA.

In some limited circumstances, researchers may be able to access data in the Secure Research Service by becoming an approved researcher through the Office for National Statistics (ONS) Approved Researcher scheme. More information and advice as to whether this scheme is suitable for your research is available by contacting research.support@ons.gov.uk.

A record of all ONS approved researchers is published on our website to ensure transparency of access to research data under the Statistics and Registration Service Act 2007 (SRSA). ONS approved researchers as listed on this public record are also recognised as accredited under the Digital Economy Act (DEA).

To request access to data in the Secure Research Service (SRS), researchers must also submit a research project accreditation application. All Digital Economy Act 2017 (DEA) research project applications will be considered by the Research Accreditation Panel (RAP), established by the UK Statistics Authority to independently consider applications for research, researcher or processor accreditation.

Accredited researchers can complete an application for project accreditation in the Research Accreditation Service (RAS).

A complete record of accredited researchers and their projects will be published on the UK Statistics Authority website to ensure transparency of access to research data.

All applications for project and researcher accreditation made under the DEA are subject to the Research Code of Practice and Accreditation criteria.

Once researchers and their research projects are accredited or approved, projects using the SRS will have a project space created. Data sets requested for projects will be mapped to the project space. Researchers may also send data to the Office for National Statistics (ONS) Statistical Support Team to be added to the project space. For more information on this process please contact us at research.support@ons.gov.uk.

Researchers named on projects will then be provided with their account details and instructions on how to access the SRS. Access to the SRS is through a safe setting. Safe settings may be in safe rooms on ONS sites, in safe rooms on other certified sites, or through an organisation which has an Assured Organisational Connectivity Agreement with ONS and which maintains a current certification.

Data owners may determine how Secure Research Service (SRS) access is permitted. Where access to the SRS is restricted to safe rooms only, the researcher will need to book a terminal at one of our safe rooms or a safe setting provided by another approved organisation. Bookings for Office for National Statistics (ONS) safe rooms can be made by accredited researchers through the Research Accreditation Service (RAS). If you are interested in booking secure rooms at other approved organisations, please contact research support, and instructions can be given where appropriate.

Before a researcher may access one of our safe rooms, they will need to complete a security declaration.

Our safe rooms are located within our offices in London (Drummond Gate), Titchfield (Hampshire) and Newport (Gwent, South Wales). We have additional safe rooms within the Scottish Government in Glasgow and at the Northern Ireland Statistics and Research Agency in Belfast. Safe rooms are open Monday to Friday from 9am until 5pm. Any changes to these hours are advertised in advance.

Remote connection to the SRS is available to organisations that can meet the safe setting criteria and achieve certification under the Assured Organisation Connectivity Scheme. Organisations interested in joining the scheme may contact research support to discuss certification requirements.

Research is conducted in the Secure Research Service (SRS) environment using software that has been tested and installed by the SRS operations and security team. The SRS makes every effort to provide software that is as up to date as possible. Table 1 provides a list of the software that is currently available to use.

Researchers can also request that code they have written is ingested into their project space. For more information please contact research.support@ons.gov.uk.

At this time, we are unable to ingest packages from open source code repositories such as CRAN or GitHub.

If you want to remove any work from the Secure Research Service (SRS), you will need to submit the file(s) for clearance to the Statistical Support Team. Statistical disclosure control will be applied to your file(s) to ensure that they are not disclosive and do not identify any individual entity. There are three types of clearance you can request:

• pre-publication clearance
• publication clearance
• code file clearance

You can request pre-publication clearance when you want to remove files from the SRS for writing up results, or for further discussion with members of the project team. These clearances can only be shared with the project team and those that have commissioned or sponsored the research as long as they are names on the project. Under no circumstance should they be published.

On completion of the project, pre-publication clearances must be destroyed. Failure to comply may result in your accredited researcher status being revoked. Pre-publication requests will take up to 48 hours to process but this does not include time taken for you to respond to any requests for clarification from the Statistical Support Team.

A publication clearance is the final intended output of your research that you want to publish or share beyond your research team. This can be in the form of a report, publication, presentation or speech but must include everything that will be disseminated, including graphics and words around the data accessed in the SRS. These clearances should be provided with any underlying data used to create tables and graphics.

Publication clearances can be kept indefinitely and distributed freely after they are approved by the Statistical Support Team. The time taken to approve publication clearances will vary depending on the size of the final output, but most are processed within 48 hours.

Both pre-publication and publication clearances must show all underlying, unweighted counts, which should adhere generally to a threshold of 10 (in some instances this may be lower or higher depending on the data). Outputs with counts below the threshold may be considered in exceptional cases, where you can demonstrate the necessity to your research and that the output is still safe.

You may also request code files for clearance, which can be shared freely once approved. These code files must not contain identifiers or any commands that may attempt to search or identify individual entities. The code should also be annotated or have commentary provided to show the intended outcome of the code to assist the Statistical Support Team with the clearance.

Code file clearance requests will take 24 hours to process. If the clearance team requires additional clarity, it will take a further 24 hours from the point of clarification being provided.

We will contact the lead researcher when a research project is approaching its expected completion date. The researcher will have the option to extend the project if more time is required.

If the research project is complete, we ask researchers to provide us with any final publications associated with the work. In some cases, we may seek to produce a case study where we see examples of innovative methodology, strong public benefit, or outstanding collaboration.

The Research Support Helpdesk is available Monday to Friday from 8am until 5pm.

The Research Support Helpdesk can be contacted by telephone on +44 (0)1329 447871 or by email at research.support@ons.gov.uk.

The Statistical Support Team are available through the Research Support Helpdesk.

Becoming an accredited researcher under the Digital Economy Act (DEA) 2017 will also allow access to other secure data services accredited under the DEA. A complete list can be found on the UK Statistics Authority website.

Office for National Statistics (ONS) approved researchers may only access secure data through the Secure Research Service and the UK Data Service (UKDS) Secure Lab.

Some organisations have arranged direct connectivity to the Secure Research Service (SRS) so that researchers working for that organisation may connect remotely to the SRS. The Assured Organisational Connectivity (AOC) scheme has been created for organisations to access the SRS from their own premises. These can include government departments or other public bodies, academic institutions, or third sector or commercial organisations operating within the research community. The AOC operates as a mark of assurance to the SRS, information asset owners, and other stakeholders. It is intended to demonstrate that organisations hosting safe settings understand their obligations, can meet the technical requirements for connectivity, have appropriate controls in place, and agree to maintain current and accurate records of connections and activity.

If you would like more information or to check whether your organisation has such connectivity to the SRS please contact research.support@ons.gov.uk. Our policy document for Assured Organisational Connectivity contains more detailed information about the AOC scheme and how organisations may apply for remote connectivity to the SRS.

The CeLSIUS team provides support to UK-based users of the Office for National Statistics (ONS) Longitudinal Study (LS) from the academic, voluntary and public sectors. They are based at UCL and the ONS office at Drummond Gate, Pimlico, London. If you are employed in one of these sectors and would like to use the LS, CeLSIUS staff will help you through the application process. In addition to becoming an accredited researcher under the Digital Economy Act 2017 (DEA), you will also need to complete the LS supplementary form which is under ”Related downloads”.

More information is available on the CeLSIUS website.

If you are interested in using the LS but are not employed in one of these sectors, or are based outside the UK, please contact the LS Development Team on: LongitudinalStudy@ons.gov.uk.

The UK Data Service (UKDS), based at the University of Essex, provides controlled access to a wide range of social and economic research data, including a number de-identified Office for National Statistics (ONS) datasets.

The Approved Researcher scheme is used to govern access to ONS data managed by the UKDS. Details of the data available and application process are available on the UKDS website.

The Office for National Statistics (ONS) is being funded to expand and improve the Secure Research Service (SRS) as part of the Administrative Data Research UK (ADR UK) partnership – an ESRC investment transforming the way researchers access the UK's wealth of public sector data, to enable better informed policy decisions that improve people's lives.

ADR UK is made up of three devolved partners (ADR Scotland, ADR Wales, and ADR NI), and the Office for National Statistics (ONS), which ensures data provided by UK Government bodies is accessed by researchers in a safe and secure form with minimal risk to data holders or the public.

The partnership is coordinated by a UK-wide strategic hub, which also promotes the benefits of administrative data research to the public and the wider research community, engages with the UK Government to secure access to data, and manages a dedicated research budget.

More information for researchers is available on ADR UK’s website.