Data safe haven

The ‘data safe haven’ terminology was used in NHS England and Scottish government information-governance literature from the late 2000s onwards, predating the dominance of ‘trusted research environment’ (TRE) as the more internationally recognised term. In current practice the two terms overlap almost completely: a data safe haven is a secure, audited computing environment that lets approved researchers analyse sensitive — often identifiable or potentially re-identifiable — datasets without the underlying data ever leaving the controlled environment. Only disclosure-checked, aggregated, or otherwise approved outputs are released to the researcher.

The Five Safes framework

Most data safe havens are organised around the Five Safes framework, originally developed for official statistics access and widely adopted across health-data and social-science secure environments: safe people (only vetted, approved researchers are granted access), safe projects (access is scoped to an approved research purpose), safe settings (technical controls prevent data leaving the environment — no local downloads, controlled export review), safe data (data is de-identified or pseudonymised to the extent the project allows), and safe outputs (results are checked for disclosure risk before release). A safe haven typically implements controls across most or all five dimensions at once, not just the technical “safe setting.”

How it differs from an open data repository

A data safe haven is the opposite operating model from an open-access repository: an open repository maximises reuse by removing access friction once data is deposited, while a safe haven exists precisely because the data cannot be safely made open at all — re-identification risk, consent scope, or legal restriction (see HIPAA or an equivalent national health-data law) rules out open deposit. Which uses are permitted inside the safe haven is typically documented in a data use agreement, and a data protection impact assessment is a common precondition for establishing a new safe-haven project. Where individual-level control over future uses also matters, see dynamic consent, a complementary participant-facing mechanism rather than a substitute for the safe haven’s own technical controls.

Worked example

The Scottish eDRIS Safe Haven links de-identified NHS Scotland administrative and health data for approved research projects; researchers log in to a controlled virtual environment, run their analysis where the data lives, and only export disclosure-checked results. Wales’s SAIL Databank operates on the same underlying model.

Counter-example

A researcher’s password-protected laptop, even in a locked office, is not a data safe haven — the data itself has left the controlled environment and is subject only to whatever device-level security the researcher happens to maintain, with no independent output disclosure check.

References

• NHS Scotland, ‘Charter for Safe Havens in Scotland’ (2015). Information Governance Review (Caldicott 2), ‘To Share or Not to Share’ (UK Department of Health, 2013).