GDPR: how do I register personal data processing activities?
Why register processing activities?
The General Data Protection Regulation (GDPR) requires that all processing of personal data at Ghent University and Ghent University Hospital be documented and registered in a 'register of processing activities', the GDPR Register.
This internal documentation obligation is an essential tool for the researcher to meet his accountability.
When to register processing activities?
Whether you are acting as a controller or as a processor, you must register processing activities that take place under your responsibility.
New processing activities
The registration must be done for each new processing activity, i.e. at the beginning of each new research project in which you process personal data (or the phase in the project in which you process personal data), and even before the start of the actual collection/processing of the data.
Existing processing activities
You must also register existing processing activities. This concerns ongoing research projects, whether they started before or after 25 May 2018 (that is the date on which the GDPR came into force).
Updates
In addition, it is important to keep the information regarding the registered processing activities up-to-date during the duration of the research project.
Where and how to record processing activities?
As of 26 June 2026, as a Ghent University researcher, you must document and register your processing activities related to personal data via Responsum (and therefore no longer via DMPonline.be). In Responsum, Ghent University staff can register both the GDPR record and (if necessary) the Data Protection Impact Assessment (DPIA). Existing GDPR records have been migrated by Ghent University to Responsum and can be consulted there.
Researchers at Ghent University Hospital can still use DMPonline.be to create a GDPR record based on the GDPR Register template, which can be used to register the processing of personal data in research. The DPIA tab of such a plan allows you to document the DPIA if your project involves high-risk processing of personal data. In that case, you will be asked a series of questions that will help you further assess and document the risks.
Data management plans (DMP) can still be created via DMPonline.be tool.
Keeping GDPR record up to date
Keep your GDPR record up-to-date in Responsum during the course of your research project. Via the 'My finalised GDPR records' tab, you can see a list of already created plans that you can then edit further. You can also find your old GDPR records that were previously created with DMPonline.be here.
Need help?
- Check out the manual for GDPR records with Responsum
- For questions about the Responsum application, contact helpdesk.responsum@ugent.be.
- More information about Ghent University's policy on Data Management Plans.
- More information about the requirements of external funders for Data Management Plans.
More information
Meer tips
- DMPonline.be: how do I write a Data Management Plan? (Schrijven)
- DMPonline.be: sign in via ORCID (Integer onderzoek & ethiek)
- GDPR: What to keep in mind when developing or deploying apps for research? (Integer onderzoek & ethiek)
- GDPR: Can I share research data with personal data with other researchers or institutions when my research project has ended? (Integer onderzoek & ethiek)
- GDPR: how can I ensure that the processing of personal data is lawful? (Integer onderzoek & ethiek)
- GDPR: how do I protect my data correctly? (Integer onderzoek & ethiek)
- GDPR: how do I register personal data processing activities? (Integer onderzoek & ethiek)
- GDPR: how long may I store research data containing personal data? (Integer onderzoek & ethiek)
- GDPR: how to be transparent to data subjects in my research? (Integer onderzoek & ethiek)
- GDPR: Manual for GDPR records with Responsum (Integer onderzoek & ethiek)
- GDPR: Pseudonymisation of personal data (Integer onderzoek & ethiek)
- GDPR: what are personal data? (Integer onderzoek & ethiek)
- GDPR: what are some things to consider when processing personal data from minors? (Integer onderzoek & ethiek)
- GDPR: What are the basic principles? (Integer onderzoek & ethiek)
- GDPR: What are the different roles and responsibilities according to the GDPR? (Integer onderzoek & ethiek)
- GDPR: What do I need to think about when transferring personal data to third countries or international organisations? (Integer onderzoek & ethiek)
- GDPR: What do I need to think about when using a mailing list in the context of my research? (Integer onderzoek & ethiek)
- GDPR: what has changed with regard to the previous privacy legislation? (Integer onderzoek & ethiek)
- GDPR: What information should I include in an informed consent form when the processing of personal data is based on the consent of the data subjects? (Integer onderzoek & ethiek)
- GDPR: what is the General Data Protection Regulation? (Integer onderzoek & ethiek)
- GDPR: What rights do data subjects have, how do I respect them and what exceptions may apply to research? (Integer onderzoek & ethiek)
- GDPR: What should I consider when using social media data for scientific research? (Integer onderzoek & ethiek)
- GDPR: what should I do in case of a data breach? (Integer onderzoek & ethiek)
- GDPR: What should I do in the event of further/secondary processing of personal data? (Integer onderzoek & ethiek)
- GDPR: What should I keep in mind when designing my research? (Integer onderzoek & ethiek)
- GDPR: what should I keep in mind when processing special categories of personal data? (Integer onderzoek & ethiek)
- GDPR: What should I take into account when developing or using AI? (Integer onderzoek & ethiek)
- GDPR: What should I think about when I collaborate with others or share my data? (Integer onderzoek & ethiek)
- GDPR: When am I processing high-risk personal data and when do I need to conduct a DPIA? (Integer onderzoek & ethiek)
- GDPR: when do I engage in 'profiling'; what should I think about? And what is 'exclusively automated individual decision-making'? (Integer onderzoek & ethiek)
- GDPR: when does it apply to my research? (Integer onderzoek & ethiek)
- GDPR: who are considered to be vulnerable persons? (Integer onderzoek & ethiek)
- GDPR: why is it important to comply with this legislation? (Integer onderzoek & ethiek)
- Qualtrics: how do I use this survey tool? (Integer onderzoek & ethiek)
- RSpace: how do I use this ELN? (Integer onderzoek & ethiek)
Vertaalde tips
Laatst aangepast 24 augustus 2026 10:15