Privacy Notice

Privacy Notice for Generation New Era families

Version 11: Applicable from: 2 November 2026

If you’d like to print this privacy notice or export it as a PDF, please select Ctrl + P on your keyboard (or Cmd+ P for Mac users).

Contents

What is a privacy notice?
About Generation New Era
What personal data do we collect and why?
Your choices: Taking part, leaving and changing your permissions
Who do we share your data with?
How do we keep your data safe?
Legal Information and Governance
Contacts and Complaints
Who we share your data with
Further information
Version control

 

What is a privacy notice?

This privacy notice explains how your personal data are used for Generation New Era (“the study” or “GNE”), including personal data provided by you or by third parties. It applies to families who take part in, or are invited to take part in, the study, and anyone whose data we hold for the study including: 

• Parents/carers
• Babies
• Other people the study collects information about e.g. family or household members

Some of this data is collected through an app designed for the study called BabySteps. 

The UCL Centre for Longitudinal Studies (“we”, “our” and “us”) values your contribution to the study. We respect your privacy and are committed to protecting your personal data.  

This privacy notice also outlines your rights under UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA).  

It is a legal requirement under UK GDPR for organisations processing personal data to provide a privacy notice which explains how this data is used.  

We review this privacy notice regularly, including when we do a new survey, and update it if we change how we process study data. It supplements the general UCL privacy notice for research participants.  

About Generation New Era

Generation New Era is a UK-wide research project. It is led by the UCL Centre for Longitudinal Studies (CLS) and funded by the Economic and Social Research Council. It is one of several studies at CLS that follow the same group of people over time – these are called ‘longitudinal birth cohort’ studies.  

Generation New Era aims to follow 30,000 children born in 2026. The study looks at things like: 

• Early child development 

• Family health and well-being 

• The impacts of COVID-19 and the cost-of-living crisis 

By providing vital new insights into the health and development of children, Generation New Era will help researchers, governments and service providers to improve the lives of children and families in the UK. 

Approval for the study 

The study has received approval across the UK, including from committees and groups that help protect the safety, confidentiality, rights, well-being and dignity of people who take part in research:

• UK-wide: An NHS Research Ethics Committee (REC)  

• England and Wales: NHS England and its independent Advisory Group for Data as well as the NHS Health Research Authority Confidentiality Advisory Group 

• Scotland: The Health and Social Care Public Benefit and Privacy Panel 

• Northern Ireland: Health and Social Care Trusts, with support from the HSC Privacy Advisory Committee and commissioning by the Northern Ireland Department of Health 

Our Partners 

The project is managed by CLS. We work with Swansea University, the University of Edinburgh, Ulster University and the Fatherhood Institute.

Three independent survey agencies carry out the interviews: 

• Ipsos (the lead agency) 

• NatCen 

• Verian 

All three agencies follow the strict Market Research Society Code of Conduct. They have lots of experience in carrying out similar studies with children and families 

Previous Phase (2023/24) 

Phase 1 involved several thousand babies born in 2022/23. We do not plan to contact Phase 1 families for further interviews, but we securely retain their interview and contact data, including name and address. We do not plan to link government-held routine records to Phase 1 survey responses. If you are one of these families, you can find out more here. 

Pilot Phase  

Before we start contacting families about joining Generation New Era in September 2026, we are doing a final test (called a ‘pilot’) with a small group of families with babies born in October 2025.  

This privacy notice applies to families in all phases of the study.  

What personal data do we collect and why?

Personal data means any information which relates to or identifies an individual. This includes information which may not explicitly identify you (e.g. where your name has been removed) but which does make it possible to identify you if it is combined with other information that is readily available. All data used by the study about you is personal data, including data provided by third parties.   

A. Contact lists from government agencies 

We apply to access birth and health records to find a diverse group of families, helping ensure our study reflects the whole UK population. The information we receive includes names, addresses and limited additional information about you and your baby – see Table 1 for full details.  

We use your contact details to inform you about the study and invite you to take part. We do not ask for your permission before contacting you. If you don’t take part, we will not keep or use this information for any other purpose. If you do take part, we will use the contact details you provide in the survey to contact you in the future.  

We also use limited additional demographic information from these records to understand who does and doesn’t take part, helping to produce accurate statistics about the UK population. This is done for all families, including those who do not take part, and this information is securely deleted once this has been done.    

The data comes from – 

• England and Wales – NHS England provide information from birth registrations (mother, baby and, if available, father) linked to birth notifications (mother and baby).  

• Scotland – Public Health Scotland (PHS) provide information from National Records of Scotland birth registrations linked to PHS maternity records (mother and baby) 

• Northern Ireland – The Health and Social Care Business Services Organisation (BSO) provide information from Health and Social Care Health Trust maternity records (mother and baby)  

NHS National data-opt out in England: This scheme allows people in England to opt out of their NHS patient information being used for research and planning. The opt-out applies before you are invited to take part in this study, and you can only be invited if you have not opted out. If you take part in the study and later opt out of your NHS patient information being used for research, your agreement to join the study and to link your health records to your survey responses will still apply. 

England, Wales and Scotland Process: Our survey agency sends an initial letter to you, giving you the opportunity to opt out of any further contact/taking part. If you do not opt out, the survey agency sends you another letter inviting you to take part. 

Northern Ireland Process: The Health and Social Care Business Services Organisation (BSO) sends an initial letter giving you the opportunity to opt out of any further contact/taking part. If you do not opt out, your name and address go to our survey agency so they can invite you to take part. The BSO receive your Health Trust data from your ENCOMPASS care record. 

Mailing support: Our survey agency uses a secure contractor named Formara to pack and post your invitation letters. 

Keeping in touch: If we lose touch with you in the future, we will try and find your new contact details and ask you if you’d like to continue taking part. For example, we might contact the person whose details you gave us during the survey to help stay in touch with you. We may also use sources such as NHS records, address checking services and publicly available information to help keep your contact details up to date. 

B. Information you share as part of the research  

Generation New Era collects information from you using interviews and questionnaires, including via BabySteps app. We refer to this information as your study data or study information i.e. information you have given to the study. 

In your interview, we ask for: 

• Information about your baby’s health and growth, behaviour and development  

• Information about your experiences as a mother or father and other aspects of your life.    

• Information about other household or family members, other children, your child’s other parent (including where they live elsewhere) and/or your partner  

• The contact details of a friend or relative who lives elsewhere. We use this to find you if you move house. Please tell them if you have shared their details. 

We ask for some information which is classified as sensitive / special category personal data under GDPR e.g. your ethnicity, sexual orientation or health status. 

You can skip any question you do not want to answer.  

BabySteps App 

The BabySteps app allows you to complete research tasks, store photos, make diary entries, record your child’s developmental milestones, and receive study updates and news. The information you enter is held securely on your phone and is yours to keep. When you register, you provide your name, your child’s name and date of birth, your relationship to the child and your email address. This information is used to support app features, personalise your experience, reset your password, and send notifications (such as about new research activities, e-voucher rewards, app updates).  

The information you enter for research activities is linked to the rest of your study data from the interviews. We securely share your email address, name and your child’s name and date of birth in the app with our fieldwork agency Ipsos, to ensure your app information is correctly linked to your survey data.    

C. Information from Other Sources (Linked Data) 

Routine records: We ask your permission to link your survey data to information from your and your baby’s health, education, and social care records held by government departments and agencies. If you agree, we will add records about your and your child’s past, present, and future circumstances. Unless you tell us to stop, we will continue to do this into the future, including if you decide not to take part in future interviews or we lose contact with you. You can tell us at any time if you change your mind about this, without giving a reason. We only ask one parent to consent for their child’s routine records to be added, so you may wish to discuss this with your child’s other parent. The parent we ask for consent for the child’s records is always a parent with legal parental responsibility, living in their child’s main household and the parent who completes the longer interview. Your child can make their own choice about linkage of routine records when they are older, around 14-16 years old. Parental permission for your child covers health records up to age 14 and education records up to age 16. In England, Wales and Scotland permission for social care records is up to age 16 and in Northern Ireland it is to age 14. Although we seek your consent for this, consent is not our UK GDPR lawful basis for processing linked information – see Lawful Basis for Processing. 

Information about where you live: We also plan to add information about your local area and home, such as air pollution, green spaces, nearby services, and home energy efficiency. Much of this information is publicly available and is not individual level information about you, so we do not ask your permission to add it. However, you can opt out by letting us know. 

Mortality data: The NHS tells us if a participant has passed away so we do not contact them.

Your Choices: Taking Part, Leaving and Changing Your Permissions    

Taking part in this study is entirely optional. We ask for your consent to take part in the study and for linking routine records to your survey answers. However, we do not use UK GDPR consent as the lawful basis for using your data – see Lawful Basis for Processing. It is up to each parent to decide if they individually want to take part and answer questions about their child.  

If you do not take part 

If you decide not to take part, we still look at some information from your birth and health records. The survey or government agency shares this data with us. It does not include your name or address. We use it to understand who does and doesn’t take part in the study, which helps to ensure accurate statistics. For those of you in Scotland and Northern Ireland, we access the data remotely through secure environments (Scotland National Safe Haven; Northern Ireland BSO Honest Broker Service). For those of you in England and Wales, we receive and hold the data in our own secure environment (the UCL Data Safe Haven). After checking the data, access to it is removed or we delete the data we hold. 

If you do not want us to use your data for this purpose, let us know.  

How to withdraw from the study or change your permissions 

You can change your mind at any time without giving a reason. You can leave the whole study or just stop one part (like linkage of routine records or use of the Babysteps app). If you choose to just stop one part, this will not affect your participation in the study as a whole. You can also ask for your data to be deleted. 

Email us at: gnestudy@ucl.ac.uk. Depending upon the nature of your request, we will take one or more of the following actions (and inform you of these) – 

• Study withdrawal or deletion of contact details: we will stop contacting you and we won’t invite you again to be part of the research. We keep your name on a secure internal list just to ensure we never contact you again. 
• Deletion of study data: If you ask us to delete your data before it is made available to researchers, we will ensure it is not shared for research purposes. However, we are not able to remove data that has already been made available to researchers through trusted data services. This data may continue to be used for research and will never include your name or address. 
• Routine records: We stop linking information from routine records to your survey responses. Past records already linked and sent to research platforms will remain there.  
• Information about where you live: We stop linking new area and property level data to your survey responses. Data already linked and sent to research platforms will remain there. 
• Babysteps: use of the app is voluntary and you can stop using it at any time. The information you put into the app will be retained on your phone unless you delete the app. This information is also stored securely on our study server, so that you can transfer it to a new phone. However, you can ask us to remove your data from our server. You can also use the ‘Delete Your Account’ section of the ‘About’ page of the app.  
  

Who do we share your data with?

We only share information to run the study or to make data available for safe research – see Table 2. Your data is never used for marketing or commercial purposes.  

• Survey Agencies: Ipsos, NatCen, and Verian use your details to visit or call you as part of the study. 

• Email & Feedback Tools: We may use Dot Digital to send emails and Qualtrics to gather feedback. We only share your first name, email, and a random serial number with them. 

• Trusted Data Services: Your survey responses, including those from the BabySteps app research activities, are put together with the answers from all the other people who are interviewed and stored in the UCL Data Safe Haven. Research data are also made available to researchers through trusted services such as the UK Data Service and the UK Longitudinal Linkage Collaboration. This allows researchers to reuse the data now and in the future, helping to produce new knowledge and make comparisons across countries UK and worldwide. Research data does not contain names, addresses or other personal details that identify individuals in the study. Also see ‘Data Security at Trusted Data Services’. 

• Researchers worldwide: Researchers from any country, not just the UK, can access the data if registered with a recognised institution. We accept applications from researchers across a range of sectors, provided that the proposed research is not undertaken for commercial gain. Applicants must sign a strict data-use agreement and conduct research for the public good. Private-sector researchers usually apply in partnership with public or charitable organisations, such as the NHS or universities.  Also see ‘Data Security at Trusted Data Services’. 

• Confidentiality: Your survey responses , including on BabySteps app, will be kept confidential, including from other members of your family and from organisations who provide services or administer benefits that you or your baby may use or receive.  

If, during the interview itself, you tell the interviewer something that makes them genuinely concerned that you or someone else is at serious and immediate risk of harm, they are trained to follow safeguarding procedures. In exceptional circumstances, they may need to share what you have told them to help keep you or someone else safe.  

Our surveys sometimes ask you to describe your experiences in your own words. We may use quotes from these answers when we talk about the research, for example in press releases. Other people will not be able to identify you from these quotes unless you have agreed to reveal your name. 

International Data Transfers 

Researchers outside the UK can access your research data – these data never include any names, addresses or other personal details that could identify you or your family. Access to more sensitive research data, such as data from routine records is often limited to researchers in the UK or countries with similar data protection legislation. We use legal agreements to ensure overseas researchers protect data to UK standards. 

How do we keep your data safe?

Strict security rules, secure systems and other technical and organisational safeguards are always used to keep your information safe and secure. All data containing contact information and sensitive or very detailed information is stored on secure servers inside the UK. 

Interviews are carried out by trained interviewers using secure computers, while online surveys, including those completed through the Baby Steps app, use secure systems accessed with a login code.  

Keeping Personal Details and Survey Data Separate 

Your personal details and contact information (e.g. full name, address) and your survey responses are separated after you’ve completed the survey and kept separate. Only an ID number is kept with your survey responses. The data is combined with other participants’ responses and securely transferred to the UCL Data Safe Haven, where data can only be accessed by authorised specialist staff – 

• Our Cohort Maintenance Team only has access to personal details such as names and addresses. 

• Our Research Data Management Team only has access to survey responses. 

Babysteps app 

BabySteps protects data transferred between your phone and its highly secure UK server using end-to-end encryption, so it cannot be intercepted. The server is owned by Amazon Web Services, who cannot access your data. Only authorised study team members can access information stored on the server. The server meets NHS, government and international security standards, including ISO 27001 and ISO 22301. BabySteps does not track your location or access information from your phone or other apps without your explicit permission. It only collects your phone type, operating system, limited technical information for support and debugging, and information you directly enter into the app.  

Data Security at Trusted Data Services 

Research data does not include names and addresses or other personal details that identify you or your family. Before securely transferring research data to trusted data services we also assess and reduce the risk of identification by combining answer categories together, restricting access to a highly secure setting, or removing information. Before the UK Data Service makes the data available to researchers, they also independently check it to make sure there is nothing that can identify individuals. Research data that does not include sensitive information and is less detailed may be released directly to researchers for them to download and use on their own workplace computers. Research data that includes sensitive information, linked routine records (such as linked information from health, education and social care records) and detailed geographic information, can only be accessed remotely by approved and trained researchers – researchers cannot download this data to their own computers. 

Security Standards 

We have policies, procedures and people in place to keep your data safe and secure. 

We and our survey agencies  

• are registered with the Information Commissioner’s Office (UCL reference is Z6364106). 

• have secure systems, hold an active ISO27001 certification (the global standard for information security) and meet the standard of the NHS Data Protection and Security Toolkit. 

• store all data on secure servers inside the UK. If you do a video interview on Microsoft Teams, your email is processed on servers within the European Economic Area (EEA), but your answers are never stored there. 

Trusted data services have secure systems and certifications (such as ISO27001) and use the ‘Five Safes Framework’, a set of principles and best practice which enable safe research access to data. 

Cookies 

This website uses cookies to help us manage the site and to understand how people are using it, so we can keep improving it. To find out more about which cookies we use and what they are for, and how to change your cookie permissions, please visit our cookies page.     

Legal information and governance

Data Controllers 

A Data Controller decides how and why your personal data is processed and is responsible for ensuring that it is processed lawfully. UCL is the Data Controller for this study. 

Public bodies (like NHS England, Public Health Scotland or Northern Ireland HSC Trusts) are independent data controllers for the list of records they initially provide to us. 

Lawful Basis for Processing 

Data protection law requires us to have a valid legal reason to hold and process your data. Our legal basis for this is – 

• Public Task (GDPR Article 6 (e)): UCL processes study data because it is a public authority conducting research in the public interest. 

• Sensitive Data (DPA 2018 Schedule 1, Paragraph 4): We process health and ethnic details for research and archiving purposes. 

• Legal Obligation (GDPR Article 6(c)): Used if we are legally required to process data. 

We have special approvals to temporarily lift the common law duty of confidentiality to invite families and to receive notifications of deaths and moves outside of the NHS: 

• England & Wales: Approved by NHS England’s Advisory Group for Data and the Confidentiality Advisory Group. 

• Scotland: Approved by the Scotland Health and Social Care Public Benefit and Privacy Panel. 

• Northern Ireland: Supported by the HSC Privacy Advisory Committee and commissioned by the Northern Ireland Department of Health. 

Your Rights 

The UK GDPR gives you rights over your data. You can ask us to: 

• Inform you how data is used. 

• Give you a copy of your data (we respond within 1 month). 

• Fix incorrect details (rectification). 

• Delete details that are no longer needed (erasure). 

• Limit how we process your data. 

Note: We use the GDPR “disproportionate effort” exception for the right to be informed prior to sending our initial letter. It is not feasible to contact every person registering a birth across the UK before drawing our sample, but we make best efforts to raise awareness of the study, including through this notice, and have Ethics Committee approval and special approvals to contact you without your prior permission. 

How long we keep data 

Because this is a lifelong study, we keep your data for as long as the study exists. This includes your study information from the interviews and the BabySteps app research activities. We review data retention whenever you make an official rights request. We hope to speak with you every few years when your child gets older. They can make their own choice about being in the study when they are older, around 14-16 years old. 

Contacts and complaints

Project Contact 

Contact us to update your details, opt out, or ask questions: 

• Email: gnestudy@ucl.ac.uk 

• Freephone: 0808 175 6330 

Data Protection Officer 

A Data Protection Officer is a position set out in the UK GDPR and DPA 2018. If you have a complaint about your privacy rights, contact UCL’s Data Protection Officer: 

• Email: data-protection@ucl.ac.uk 

• Post: Data Protection Officer, UCL, Gower Street, London WC1E 6BT 

You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk. 

Information Asset Owner 

An Information Asset Owner (IAO) is a senior individual responsible for managing and protecting information assets within an organisation. For Generation New Era the IAO is Professor Lisa Calderwood. 

Who we share your data with

This Table reflects the information we hold and share for families in the study.

Table 1: Summary of the sampling data that we hold about you, where we get this data from (sources), who receives this data and the purposes of processing.
Types of data that we hold about you	Sources of data/Data Controllers other than UCL	Who receives your data	Purposes of processing
ENGLAND AND WALES
Birth registration records: ·       Date of birth mother ·       Date of birth father ·       Date of birth baby ·       Sex of baby ·       Multiple births ·       Socio-economic status code of mother and (if registered) father ·       Occupation code of mother and (if registered) father ·       Date of registration ·       Registration type (joint/sole) ·       Birth registration informant type (e.g. mother, father) ·       Birth in / outside marriage ·       Name and address mother ·       Name and address father (if registered) ·       Baby name ·       Country of birth mother ·       Country of birth father (if registered) ·       Previous births of mother	NHS England	·      Survey agency ·       UCL	To draw the sample, send out invites and carry out recruitment for the study.   Methodological purposes (to understand how representative the study is of the wider population). For those who do not take part, UCL receive de-identified data.
Health records: ·       Age of mother ·       Multiple births ·       Birthweight baby ·       Address mother ·       Address father ·       Address baby ·       Ethnicity baby ·       Previous births mother ·       Gestational age baby ·       NHS Number mother ·       NHS Number father ·       NHS Number baby ·       Mortality data and moves out of the NHS for baby, mother and father	·       NHS England birth notification records and Personal Demographics Service (PDS)	·       Survey agency ·       UCL	To draw the sample and send out invites and carry out recruitment for the study.   Methodological purposes (to understand how representative the study is of the wider population). For those who do not take part, UCL receive de-identified data.
SCOTLAND
Scottish Linked Pregnancy and Birth Dataset (heath and birth registration records): To survey agency   – Mother month and year of birth – Number of births this pregnancy – Ethnicity mother – Ethnicity baby – Baby month and year of birth – Sex of baby – Address mother – Mortality data and moves out of the NHS for baby and mother	– Public Health Scotland – National Records of Scotland (NRS) – NHS Scotland Health Boards	·       Survey agency ·       UCL	To send out invites, and carry out recruitment for the study.   Methodological purposes (to understand how representative the study is of the wider population). For those invited to participate and who do not take part, UCL receive de-identified data.
Secure access provided to survey agency and UCL via Scottish National Safe Haven (de-identified for all) – Mother month and year of birth – Number of births this pregnancy – Ethnicity mother – Ethnicity baby – Baby month and year of birth – Gestational age baby – Birthweight baby – Country of birth mother – Country of birth father – Socio-economic status code of mother – Socio-economic status code of father – Employment status mother – Employment status father – Mother Datazone end of pregnancy – Father Datazone end of pregnancy – Parents married indicator – Number previous pregnancies mother – Father banded age	– Public Health Scotland (PHS) – National Records of Scotland	·       Survey agency ·       UCL	To select the sample. For all, survey agency receive secure access to de-identified data via the National Safe Haven.   Methodological purposes (to understand how representative the study is of the wider population). For all, UCL receive secure access to de-identified data via the National Safe Haven.
NORTHERN IRELAND
Health records:  To survey agency  ·       Name and address mother  ·       Mother month and year of birth  ·       Baby month and year of birth   ·       Mortality data and moves out of the NHS for mother and baby  Secure access provided to UCL via BSO Honest Broker Service (de-identified for all) ·       Multiple births  ·       Birth type (multiple singleton)  ·       Birthweight  ·       Ethnicity baby  ·       Ethnicity mother  ·       Previous births  ·       Gestational age  ·       Baby month and year of birth  ·       Mother month and year of birth   ·       Mother’s country of birth ·       Baby’s sex	– Northern Ireland Encompass system / Northern Ireland Digital Identity Service (NIDIS) – Business Services Organisation (BSO)	·      UCL   ·      Survey agency	To send out invites and carry out recruitment for the study (following an opt out letter sent by BSO)   Contact details only provided to survey agency for those who do not opt out.     Methodological purposes (to understand how representative the study is of the wider population) For all, UCL receive secure access to de-identified data via the BSO Honest Broker Service.

Table 2: Summary of the data that we hold for participants in Generation New Era and who we share it with
Types of data that we hold about you	Controllers	Categories of recipients	Purposes of sharing your data
Contact details, personal information, email address	UCL	International email, marketing automation, and customer engagement service provider   Survey agencies and their contractors responsible for participant mailings Collaboration platforms	To contact you and keep your record up to date for the purposes of Generation New Era.
Survey answers including through the BabySteps App	UCL	Survey agencies  Trusted research environments	For research, statistical and archiving purposes.
Research data from the study including:  – Data from the data linkage programme (e.g., received from NHS organisations, government departments, research and statistics organisations, databanks).	UCL (and public sector bodies for specific projects)	Survey agencies  Trusted research data services  Researchers/research organisations  SAIL	To add information to your record.  For research purposes.  For contact tracing.
Name, sex, postcode, date of birth, address, NHS number/ID (if known) and study ID (study-specific pseudonymised  identifier).	UCL	Government departments  NHS organisations  Trusted external organisations for data linkage   Research/statistics organisations	To contact you and keep your record up to date for the purposes of the study.
Publicly available information (e.g., contact details from social media)	UCL		To contact you and keep your record up to date for the purposes of the study.
Personal information, sensitive/special category personal data	UCL, relevant authorities/bodies	Public sector bodies/authorities (e.g., police, NHS, social services) your stable contacts	To meet our legal obligations. For safeguarding purposes.

Further Information

This privacy notice supplements the following UCL Privacy Notice(s): Research participants for health case purposes privacy notice: https://www.ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies

Version control

We keep this privacy notice under regular review to make sure it is up to date. The last update was on: 2 November 2026.