(re)search tips

Practical tips for research, information management and scholarly communication

GDPR: what should I keep in mind when designing my research?

Privacy by design

In the design phase of a research project, you normally think about the substance and methodological aspects of your research.

In view of the General Data Protection Regulation (GDPR) it is important to also thoroughly consider and describe the collection and processing of personal data during the design phase (privacy by design). This also falls under research data management more broadly.

  • is it necessary to process personal data? If this is not necessary for your research, it is better to use anonymous data
  • how can I minimise this data? Try to limit the data to those data that contribute to answering the research question
  • are these data that I have collected myself (primary data), or existing data from other scientific research or from existing databases (such as patient data in a hospital, Crossroads Bank companies register, etc.) (secondary data or further processing)?
  • do I need to process raw personal data, or can I work with pseudonymised data after collection?
  • does the way in which I process the personal data entail risks for the data subjects? For example, will you gather sensitive personal data? Will you collect personal data from vulnerable persons or from minors? Will systematic monitoring be done, etc.?
  • on what legal basis am I basing my personal data processing?
  • how will I inform the data subjects in a transparent manner?
  • are the personal data shared with other people within or outside Ghent University?
  • what are the roles of these persons and/or institutions or organisations, and have the necessary agreements been drawn up for this?
  • will I collaborate with other researchers, institutions or organisations or transfer personal data outside the European Economic Area (EEA)?

More information

More tips

Translated tip


tags:

Last modified Aug. 31, 2021, 1:56 p.m.