How to handle personal data in a research project

It is important that you know your role in the processing of personal data.  You can be a data controller or a data processor.

• Data controllers decide alone or with others for what purposes a project will process personal data.
• Data processors are external parties that process data on the instructions from and on behalf of SDU. Examples of data processors could be Statistics Denmark, SurveyXact or OPEN.

Notice that you yourself are not data controller or data processor. The data controller or data processor is your employer, SDU, when you process personal data in a project during your employment at the university.

In both cases contact Legal Services

SDU is a data controller when the project is placed in a department or center at the university. In that case you must register your research project so it will be implemented in SDU’s register of projects that works with personal data.

If you collaborate with data processors or if SDU is the data processor, a written data processing agreement must be made before the data processor gains access to the data.

In both cases you should contact Legal Services in SDU RIO as all agreements on personal data must be approved and signed here.

If you have questions, please contact us.

You have to consider for what purpose and on what legal basis you want to process personal data in your research project.

It is essential whether the personal data is used for research purposes only, or whether it is also used for other purposes - fx teaching, administration, etc.

Consider legal basis: consent or public interest

In research contexts, a distinction is made between processing on the basis of consent or processing on the basis of section 10 of the Danish Data Protection Act which covers research in the public interest.

When you process personal data based on the research provision in the Data Protection Act 10, the data can be used for research only.

This means that none of the data can be used for teaching, quality assurance, administration, or similar purposes if the data is personally identifiable. However, anonymized results can be used for purposes other than research.

Always assess whether the project can be carried out with less or less intrusive personal data. If name, region and age, for example, are sufficient for the purpose of the research project, you should not also process civil registration numbers, trade union affiliations etc.

There are pros and cons to both legal bases, and you should consider them carefully before you start collecting and processing personal data.

If you have questions, please contact Legal Services in SDU RIO.

When you collect personal data - fx through questionnaire surveys, interviews, video or audio recordings - you must provide certain information to the participant and comply with the duty to inform. 

You should make a consent form for the participant to sign. When you process personal data based on the participant’s consent, you can only use the personal data for the purposes described in the consent. 

The person who signs your consent form must be informed about:

• The name of the data controller
• Information about the Data Protection Officer
• The purpose of the project
• The duration of data storage
• The legal basis for the processing and the types of information to be processed
• The voluntary nature of participation and the possibility to withdraw consent
• The identity of potential recipients of the information and the purpose of disclosing the information
• The right to lodge a complaint with the Danish Data Protection Agency, to access, rectify, and erase data
• Any other necessary information for the data subject/participant to safeguard their interests.

The consent must comply with the General Data Protection Regulation, but otherwise you can design it so it meets your particular needs.

As a general rule, you may only use SDU-approved systems.

SDU recommends that you use SharePoint, Nextcloud, Onedrive, S4 or Ucloud.

If you have to use other systems for processing personal data, please contact Legal Services.

If you process data based on participant consent, you have the option to obtain consent for disclosure either subsequently or already during data collection.

If you do not receive consent from the participant, you cannot disclose data collected based on consent.

Reuse of personal data in new projects also requires consent, so it is crucial to have a clear understanding of what is agreed upon in the consent.

If you use the research provision, personal data may only be disclosed to third parties with prior approval from SDU RIO.

Reuse of personal data

You can reuse personal data in another project if it is for research purposes. It is important that you get permission from Legal Services for transferring data to a new project.

If you want to share personal data with colleagues at SDU, other universities, companies or organizations, it must be clarified whether an internal approval, a permission from the Danish Data Protection Agency or a data processing agreement is required.

Information are to be processed in a form where it is not directly identifiable - in encrypted or pseudonymized form.

Research results must be anonymized, and no publication of personal data should occur unless there is consent from the participants or approval from the Danish Data Protection Agency.

Personal data must be deleted, anonymized, or archived when the project is completed, unless there is consent from the data subject for further processing.

What to do depends to a large extent on what you have written in your Data Management Plan, in the registering of your research project to Legal Services in SDU RIO and what you have promised the participants.

Therefore, you should be aware of the following:

• Employees handling personal data must receive instruction and training in data protection and handling.
• Access to personal data must be restricted so that employees only have access to relevant data.
• At least every six months, you must determine whether the employees in question still need access to the data.

If you want to know more about the possibility of retaining data - fx at the Danish National Archives - please contact Legal Services.

Notice as to whether some data are subject to an obligation to keep records. If you have any questions about record-keeping, feel free to contact ESDH.

Pictures are personal information regardless of whether the picture is a portrait or a picture of the surroundings where a person happens to appear.

The same is the case with sound recordings.

If you use pictures or sound recordings you must register your project as with all other research projects in which personal information is processed.

Legal Services in SDU RIO can provide guidance on whether consent is needed or whether the information can be processed according to another legal basis.

Students who work with research data do not necessarily have to sign a data processing agreement. It depends on the circumstances.

Please contact Legal Services in SDU RIO to hear about the possibilities.

If you discover that you or others in your project shared personal data that you should not have shared, please report it as soon as you find out.

When  a security breach has occured, you should fill in this form as soon as possible and without undue delay.

Read more about security breaches, fx the definition on a security breach and examples on different kinds of security breaches.

If you have questions, please contact Legal Services in SDU RIO.