GDPR: how can I protect my data correctly?
When you process personal data you have the ethical and legal obligation to ensure that personal data are sufficiently protected.
The basic level of security must always be in accordance with the information security policy of Ghent University. However, additional measures may be necessary specifically for each processing. The choice of additional security is based on an assessment of the risks of the processing. Processing involving more risks will have to be accompanied by a more extensive set of safety measures.
In the area of data protection, anonymisation, pseudonymisation and encryption are put forward by the GDPR and sometimes even required as guarantees.
Anonymisation
When you collect personal data and then anonymise them, this processing constitutes anonymisation under the GDPR. Anonymisation means that the data subject (the individual to whom the data relates) can no longer be identified and it is not possible to re-identify the data subject. Please note that the natural person may not easily be re-identified if someone, for example, were to link this dataset with another dataset.
Pseudonymisation
If anonymisation is not possible, it is advisable to separate the personal data as quickly as possible from the research data (pseudonymisation). The key file must be kept in a separate and safe place, and should preferably be encrypted. Only the researchers involved have daily access to the pseudonymised data. Access to raw personal data is highly restricted.
Encryption
The use of encryption for storage or data transfer is also strongly recommended by the GDPR. You can choose to encrypt one or more files or to encrypt the entire system disk of your laptop or computer. For an overview of the different encryption options, be sure to check out the encryption manual for researchers.
In addition to anonymisation, pseudonymisation and encryption, there are a host of other organisational and technical security measures to mitigate the risks involved:
- storage of data files or documents on the University network drives or centrally offered storage options
- two-factor authentication to protect accounts
- clean desk policy
- key policy of offices
- use of Windows screen saver L key to block screens
- use of secure systems for the transfer of data (e.g. Belnet FileSender)
- use of secure procedures for destroying data
For more information and tips on how to handle your data safely, see the page about datasecurity.
More tips
- GDPR: Can I share research data with personal data with other researchers or institutions when my research project has ended? (Integrity in science)
- GDPR: how am I transparent to data subjects in my research? (Integrity in science)
- GDPR: how can I ensure that the processing of personal data is lawful? (Integrity in science)
- GDPR: how do I register personal data processing activities? (Integrity in science)
- GDPR: how long can research data containing personal data be stored? (Integrity in science)
- GDPR: what are personal data? (Integrity in science)
- GDPR: what are the basic principles? (Integrity in science)
- GDPR: what are the different roles and responsibilities according to the GDPR? (Integrity in science)
- GDPR: What do I need to think about when transferring personal data to third countries or international organisations? (Integrity in science)
- GDPR: what has changed with regard to the previous privacy legislation? (Integrity in science)
- GDPR: what information should I include in an informed consent form when the processing of personal data is based on the consent of the data subjects? (Integrity in science)
- GDPR: what is the General Data Protection Regulation? (Integrity in science)
- GDPR: what rights do data subjects have, how do I respect them and what exceptions may apply to research? (Integrity in science)
- GDPR: What should I do if there is a data breach? (Integrity in science)
- GDPR: what should I do in the event of further/secondary processing of personal data? (Integrity in science)
- GDPR: what should I keep in mind when designing my research? (Integrity in science)
- GDPR: what should I keep in mind when processing special categories of personal data? (Integrity in science)
- GDPR: What should I think about when I collaborate with others or share my data? (Integrity in science)
- GDPR: What should I think about when processing personal data from minors? (Integrity in science)
- GDPR: When am I processing high-risk personal data and when do I need to conduct a DPIA? (Integrity in science)
- GDPR: when does it apply to my research? (Integrity in science)
- GDPR: who are considered as vulnerable persons? (Integrity in science)
- GDPR: why is it important to comply with this legislation? (Integrity in science)
Translated tip
Last modified Oct. 1, 2020, 11:57 a.m.