The GDPR does not prevent research data containing personal data from being shared with other researchers for reproducibility and reuse after the research.
What are the conditions for the reuse of personal data?
Sufficient technical and organizational measures must be taken such as pseudonymization, limitation of access to the data, ...
Informing the persons whose personal data are processed (the data subjects) is one of the basic principles and obligations of the General Data Protection Regulation (GDPR).
As a researcher, it is your responsibility to communicate this information to the data subjects in a concise, transparent, comprehensible and easily ...
The processing of personal data is only lawful if one of the conditions or legal grounds of the General Data Protection Regulation (GDPR) is met.
It is very important to indicate the applicable legal basis for the processing at the start of your research in the GDPR register. The processing ...
When you process personal data you have the ethical and legal obligation to ensure that personal data are sufficiently protected.
The basic level of security must always be in accordance with the information security policy of Ghent University. However, additional measures may be necessary specifically for each processing. The ...
Why register processing activities?
The General Data Protection Regulation (GDPR, known as AVG in Dutch) requires that all activities concerning the processing of personal data at UGent and UZ Gent are documented and registered in a 'register of processing activities', the GDPR Register.
This internal registration replaces the ...
The General Data Protection Regulation (GDPR) requires that personal data cannot be kept longer than necessary to achieve the purposes for which they are processed (see the ‘storage limitation’ principle).
The RDM Policy framework of Ghent University requires that research data be kept for a minimum of 5 ...
Personal data are any information about an identified or identifiable natural person. A natural person is considered to be identifiable if he or she can be identified directly or indirectly.
some examples of 'normal' personal data include: name, address, e-mail address, photo, ID number, IP address, employee ...
The General Data Protection Regulation (GDPR) is based on six basic principles that you must take into account when processing personal data.
1. Lawfulness, fairness and transparency
You are obliged to process personal data in a transparent manner with respect for all applicable laws, regulations and rules. ...
Various roles are defined within the General Data Protection Regulation (GDPR) for the processing of personal data. The most important roles are:
Joint data controller
Since controllers and processors have different responsibilities and obligations, it is important that you clearly define these roles (together with ...
If you collaborate with researchers, partners or institutions located in another country, within or outside the EU, in your research, you must pay attention when making personal data accessible, forwarding or exchanging. This also applies when you use processors or subcontractors, such as Qualtrics (processor based in the USA). Moreover, ...
Although the main components of the previous privacy legislation are largely retained, the General Data Protection Regulation (GDPR) also introduces a number of important changes.
The former 'obligation to report' to the privacy commission was replaced with 'accountability' whereby you as the researcher must document the processing of ...
To be lawful, the processing of personal data must be based on one of the legal grounds provided in the General Data Protection Regulation (GDPR).
If the processing of personal data within your research project is based on the consent of the data subject as the legal basis, ...
When you process personal data for your research, you must follow the rules of the General Data Protection Regulation (GDPR).
The GDPR: new European privacy legislation
The GDPR, which has been in force since 25 May 2018, modernises the existing privacy legislation. It creates a uniform European legislative framework ...
The General Data Protection Regulation (GDPR) defines the persons whose personal data are processed as data subjects.
As a researcher, you have to take into account that the data subjects can in accordance with the GDPR exercise different rights with regard to their personal data.
1. Right to information ...
A data breach is a security incident that affects the confidentiality, integrity or availability of personal data. Possible incidents that can lead to a data breach are:
access to personal data by an unauthorised third party;
intentional or unintentional action that affects the security of personal data;
sending personal data ...
Primary vs. secondary processing
In the case of further or secondary processing of personal data in a research project, the personal data will not be directly collected from the data subjects by you.
If you do collect the personal data directly from the data subjects as part of your research ...
Privacy by design
In the design phase of a research project, you normally think about the substance and methodological aspects of your research.
In view of the General Data Protection Regulation (GDPR) it is important to also thoroughly consider and describe the collection and processing of personal data during the ...
Special categories of personal data (sensitive personal data)
Some personal data belong to the group of “special categories” of personal data: these are personal data revealing racial or ethnic origin, political views, religious or philosophical beliefs, membership of a trade union, genetic data, biometric data, data about health ...
Research data with personal data can be shared within Ghent University with researchers within your own research project or with fellow researchers under certain conditions for further processing or reuse of the research data. It is important to document and justify this transfer of data in the GDPR register. Also, ...
Minors (children below the age of 18 year) have the right to specific protection, as they are often less aware of their rights, the possible risks and consequences associated with the processing of their personal data.
Children must be informed about which data are collected, what they will be ...
What is a DPIA?
When the personal data or the nature of the processing probably entails a high risk for the data subjects, the GDPR obliges you to carry out a risk analysis before the start of the processing, a so-called Data Protection Impact Assessment (DPIA).
A DPIA is ...
The General Data Protection Regulation (GDPR) applies
when you (or your institution or organisation) process personal data in the framework of scientific research (e.g. collection, recording, classification, structuring, storage, adaptation or alteration, retrieval, consultation, use, etc.), regardless of the origin of the personal data
when you (or your institution or ...
Sometimes mention is made of vulnerable natural persons in the context of the General Data Protection Regulation (GDPR).
babies and young children
people with mental disorders
people with disabilities
the sick and patients
These are often persons who are legally ...
Protecting the rights and freedoms of data subjects
If you process personal data, your job is to protect the rights and freedoms of data subjects in accordance with the General Data Protection Regulation (GDPR).
For this you must evaluate the possible risks associated with the processing of personal data ...