Handling personal data in research with care
This information applies to all processing of personal data that takes place in the context of scientific research under the responsibility of Tilburg University and applies to anyone working under the responsibility of Tilburg University.
The GDPR also has a number of important implications for scientific research. By handling research data and personal data with care from the start, you don’t have to arrange matters at the end of the process. In addition, such research usually requires ethical approval. By following the procedure of the ethical review board, you have already thought about the necessity of the data, the type of data you need to collect and how you are going to collect, analyze and store them. Following this procedure also makes sure that the research is registered in the processing register and that the pre-DPIA (Data Protection Impact Assessment is carried out, thus fulfilling the obligation in the GDPR to account for the use of personal data.
When using panel or public datasets, in some cases the GDPR does not apply, for example if the data is anonymous. This document helps determine whether the dataset falls within the scope of the GDPR.
These web pages further explain some of the GDPR rules for scientific research. The Thematic Policy Scientific Research contains more information and the accompanying one-pager contains references to key sections of the thematic policy. For questions, please contact the data representative of the Research Support Team.
Three phases of scientific research
It is important to pay attention to the personal data in your research both before, during, and after completion of your research.
These three phases have their own aspects with regard to the protection of personal data, which you as a researcher must take into account. Below we list them briefly, with references to the relevant information:
Before
- Establishing the processing basis
- Determining the personal data necessary for the research
- Purpose limitation
- Application at the ERB (Ethical review, Data management plan and processing register)
- Informed consent
- Data Protection Impact Assessment (if necessary)
- Processing by third parties
-
How do you process personal data in research lawfully?
In order to use personal data in research, you need to ensure that the processing is lawful with respect to those whose personal data you are processing (also called data subjects).
-
What personal data can you collect in research and how long can you keep these?
Besides establishing that you may process personal data, you will also have to determine exactly what kind of personal data you are going to collect and how long you may keep those personal data. On this page you will find more information and guidelines.
-
What are the rights of respondents?
The respondent has a number of rights before, during and after the survey.
-
How do you guarantee the careful handling of research data with personal data?
During each research in which Personal Data is procesessed, it is important that this data is carefully handled. This page describes how you ensure the careful handeling of such data.