Effective interpretation of, and compliance with, data protection and freedom of information law across the range of administrative and educational activities undertaken in a UK higher educational institution are tasks which, over a decade after the passage of the legislation, remain fertile ground for disagreement, misunderstanding and poorly conceived institutional policymaking. For social science researchers, the issue is further complicated by the need to simultaneously interpret and implement research ethics guidelines promulgated by diverse external bodies: the Research Councils, subject-specific research associations and other cross-disciplinary special interest groups. The cascade of new information communication technologies (ICTs) available to the social science researcher completes a triangle of policy variables and uncertainties for both researchers and institutional research scrutiny bodies. The aim of this article is threefold: first, to examine some of the issues raised by the application of data protection and freedom of information law to research in the social sciences, with a particular eye to the impact of ICTs; second, to discuss how the interplay between legal rules, ethical guidelines, and institutional regulation is developing; and finally, to suggest some potential ways forward.