Educational resource
Data linkage connects records from different sources to build a more complete picture. This page explains how it works, where it can go wrong, and why the decisions made in linkage systems matter for research, services and people.
What is data linkage?
Data about the same person or event is often held in separate datasets by different organisations. For example, one dataset might contain GP records, another might hold hospital admissions, and a third might store school attainment or housing information. Each was collected for a different purpose, using its own systems and formats.
Data linkage connects these records so they can be analysed together, without always sharing the full underlying data. Instead, selected identifiers are compared to work out which records are likely to belong to the same person or event. Examples include linking GP and hospital records to understand care pathways, or combining school attainment with housing data to explore how home environment relates to education.
Dataset A: GP records
J. Smith, DOB 04/06/1982, Postcode SW1A
↔ linked on shared identifiers
Dataset B: Hospital admissions
J. Smith, 4th June 1982, SW1 area
Linkage is rarely a simple yes/no. It produces a probability — a measure of how confident the system is that two records belong to the same person.
How evidence builds up — [placeholder for video]
How are records linked?
Linkage methods range from exact matching to probabilistic scoring. Each involves choices — about which fields to use, how much weight to give them, and what threshold to treat as a match.
Exact matching
Fields must match precisely. Fast and simple but misses records with typos, name changes or formatting differences.
Probabilistic matching
Each field agreement or disagreement contributes a score. A threshold is set — records above it are treated as a match. The threshold is a choice that affects error rates.
Deterministic rules
Sets of rules define what counts as a match (for example, name + date of birth + postcode). Reliable where data is clean; brittle where it isn’t.
Every method involves a trade-off. Stricter thresholds reduce false matches but increase missed matches. Looser thresholds do the reverse. There is no perfect setting.
Privacy-preserving record linkage
Standard linkage methods require identifying information — names, dates of birth, postcodes — to be shared between datasets. Privacy-preserving record linkage (PPRL) uses cryptographic techniques to link records without exposing the underlying personal data.
Hashing & pseudonymisation
Personal identifiers are transformed into fixed-length codes (hashes) before sharing. Records are linked by comparing hashes, not the original values. If done correctly, the original data cannot be recovered from the hash.
Bloom filters
A probabilistic technique that encodes character-level information into a binary vector. Bloom filters allow approximate string matching on encoded data, enabling probabilistic linkage without revealing the raw identifiers.
Secure multi-party computation
An approach where multiple parties jointly compute a result — such as a set of matched record pairs — without any party learning the other’s input data. Computationally intensive but offers strong privacy guarantees.
PPRL is not a silver bullet. Hashed identifiers can sometimes be re-identified through dictionary attacks if the input space is small or predictable. Bloom filters can leak information about the original data. The privacy guarantees depend on careful implementation and threat modelling.
This is an active area of research. Methods continue to develop, and no single technique is universally appropriate — the right approach depends on the data, the risk environment, and the governance context.
False matches and missed matches
Two types of error occur in data linkage. Both matter — and both can have real consequences for research findings, public services and the people represented in the data.
False match
A false match occurs when two records from different people are incorrectly linked together. The system treats them as the same person when they are not.
Possible consequences
- Research findings may be skewed if two people’s data are combined.
- A person may receive communications, decisions or services intended for someone else.
- Medical, financial or legal records could be merged incorrectly.
- Analysis of outcomes may attribute one person’s events to another.
False matches are not always detected. Once two records are linked, downstream systems often treat the link as fact.
Missed match
A missed match occurs when two records that do belong to the same person are not linked. The system treats them as different people when they are the same.
Possible consequences
- A person may be excluded from a study or benefit they are entitled to.
- Services may not recognise a person’s full history.
- Research cohorts may be incomplete, particularly for people with complex records.
- Outcomes for certain groups may be undercounted or invisible in analysis.
Missed matches often go unnoticed precisely because the person is absent — there is no record to flag the gap.
Errors are not evenly distributed
Linkage errors tend to cluster. People whose names are recorded inconsistently, who have moved frequently, whose date of birth was mis-transcribed, or whose records span multiple systems are more likely to experience both false matches and missed matches. This means that linkage quality can vary across population groups — and that the people most likely to be affected are often those whose records are already less complete or less consistently maintained.
This is not always the result of deliberate choices. It can emerge from the way data was originally collected, from legacy systems with different conventions, or from how identifiers were defined. But the effect on analysis and on individuals can be significant, and it is a reason to examine linkage quality carefully rather than assuming it is uniform.
Why linkage quality differs
The quality of a linkage depends on the quality of the underlying data, the method used, and how carefully the process is validated.
How does data quality affect linkage?
Data recorded inconsistently — different name formats, date formats, or postcodes — makes matching harder. Records with missing fields or historical transcription errors are especially affected. Linkage quality tends to reflect the quality of the systems that originally collected the data.
Does the population being studied matter?
Yes. People who move frequently, have name changes, or appear in multiple systems under different identifiers are harder to link reliably. Studies of specific demographic groups may therefore have systematically different linkage quality — which can affect the validity of comparisons.
What is a linkage rate, and why does it matter?
A linkage rate is the proportion of records that were successfully linked. A high rate is generally better, but the rate alone doesn’t tell you about false matches. Validation — comparing linkage outputs against known data — is needed to understand both error types.
Can linkage quality be improved?
Often, yes — through data cleaning before linkage, better identifier collection at the point of data entry, and by using multiple linkage methods and comparing results. But improvement requires effort, resource and sometimes changes to how data is originally collected.
Law and governance
Data linkage in the UK operates within a legal framework designed to protect individuals while enabling research and public benefit. The framework includes data protection law, information governance standards and, in some cases, specific legislative gateways.
What legal basis is used for data linkage?
Data linkage must have a lawful basis under the UK GDPR and Data Protection Act 2018. This may include Article 6(1)(e), where processing is necessary for a task in the public interest. Where health or other special-category data are used, an additional condition—often Article 9(2)(j) for research—must also apply.
Separate legal gateways may permit data to be disclosed. For some public-authority data used in accredited public-good research, this may include the Digital Economy Act 2017. For confidential patient information in England and Wales, projects that cannot practicably obtain consent may seek support under section 251 of the NHS Act 2006 and the associated Control of Patient Information Regulations.
The precise legal basis, gateway and approvals depend on the organisations, data and purpose involved.
Who provides oversight?
Oversight depends on the data, organisations and purpose involved. The organisations responsible for the data remain accountable for deciding whether linkage is lawful, necessary and proportionate. The Information Commissioner’s Office regulates compliance with data-protection law.
Health-data projects may also be reviewed through NHS England’s data-access processes, research ethics committees and the Health Research Authority. Where confidential patient information is used without consent, the Confidentiality Advisory Group advises on applications for section 251 support.
Research using public-authority data under the Digital Economy Act may require accreditation overseen by the UK Statistics Authority’s Research Accreditation Panel.
Many secure data services apply the Five Safes:
- Safe people: approved and trained users
- Safe projects: appropriate work serving the public good
- Safe settings: secure environments for accessing data
- Safe data: information prepared to reduce disclosure risks
- Safe outputs: results checked before release
These safeguards work together; no single safeguard is sufficient by itself.
What is a data access agreement?
Projects using linked data typically operate under a formal data access agreement specifying what data is used, for what purpose, by whom, and for how long. These agreements are a governance mechanism — they set conditions on use and provide accountability.
Legal compliance is necessary but not sufficient. Meeting the minimum legal threshold does not automatically mean a linkage project is trustworthy, well-governed or designed in a way that serves the public. Governance and public engagement go further.
Trust, social licence and public benefit
Data linkage depends on public trust. People’s records are used — often without their individual knowledge or consent — on the basis that the use is lawful, proportionate and genuinely beneficial. That trust is not automatic. It is built through transparency, accountability and meaningful public engagement.
Social licence refers to the broader public acceptance of a practice. It goes beyond legal permission. A project may be lawful but still lack social licence if the purpose is unclear, the benefits seem to accrue only to institutions, or affected communities have had no voice in its design.
The Link Lab’s work is grounded in the belief that better public understanding of data linkage strengthens the conditions for trustworthy research. When people understand how their data is used — and have the tools to engage critically with that — they are better placed to hold institutions accountable and contribute to shaping how data systems work.
For researchers and practitioners
Transparency about linkage methods, quality and governance is part of responsible practice. Clear documentation, accessible language and genuine engagement with affected communities build the conditions for durable public trust.
Looking for a more technical definition? Visit the UK Data Linkage Community Glossary
For everyone
Understanding data linkage is not only a technical matter. It is a civic one. The decisions made in linkage systems affect who is visible, who is counted, and whose outcomes are understood — and those decisions deserve public scrutiny.
Want to explore this further?
The Link Lab creates games and workshops that make data linkage tangible. Explore the game, book a workshop, or get in touch.