This paper expands on some of the legal issues identified in the Sudlow Review as barriers to data sharing in for health research. These stem from two separate areas of law, but which have overlapping concerns, and which use similar terminology – the common law duty of confidentiality and data protection law. This paper sets out the barriers encountered under both and proposes options and recommendations for improving data access.