GDPR: What should I think about when I collaborate with others or share my data?
Research data with personal data can be shared within Ghent University with researchers within your own research project or with fellow researchers under certain conditions for further processing or reuse of the research data. It is important to document and justify this transfer of data in the GDPR register. Also, do not forget to complete the register for each new processing by yourself or by fellow researchers within your own institution.
What are the conditions for the reuse of personal data?
- Sufficient technical and organizational measures must be taken such as pseudonymization, limitation of access to the data, encryption, ...
- The principle of data minimisation must be respected (do not collect more personal data than necessary and do not transmit more personal data than necessary).
- If the research goal of the reuse can be achieved with anonymous data, this is definitely preferred.
- The purpose of the reuse must fall within the expectations of the data subjects.
- If the data was originally collected on the basis of consent, consent must also be requested for reuse.
If the data is shared with people outside Ghent University, it is necessary to draw up an agreement to record the content of the transfer and the processing. There are a number of possible agreements depending on the roles that these institutions or persons play in the processing of personal data during or after your research:
- If you are working within a research project, with a processor, or if you (Ghent University) also take on the role of processor, a processing agreement must be prepared. A processing agreement stipulates how the personal data can be processed, who has access and for what exact purpose they can be used.
- If, in addition to Ghent University, another researcher, institution or organisation is a controller (i.e. joint controller) you must record in (an addendum to) the consortium agreement or cooperation agreement who is responsible for providing information to the data subjects and for the exercise of the rights of the data subjects.
- When (personal) data are transferred between two researchers, institutions or organisations where the other party re-uses the data for their own purposes, a data transfer agreement is drawn up. Just like in a processing agreement, the data transfer agreement determines how the personal data can be processed, who has access and for what exact purpose they can be used.
- If other researchers wish to reuse your data (which contain personal data) after your research, a license or user agreement will be drawn up. These agreements clearly state the conditions under which your data can be reused.
You can contact firstname.lastname@example.org to draw up these contracts.
In addition to the roles that researchers, institutions and organisations play, the country in which these researchers, institutions or organisations are located may also set certain requirements or conditions for the transfer of data. For more information take a look at the research tip on transfers of personal data to other countries or international organisations.
Last modified Oct. 29, 2020, 10:58 a.m.