Data Protection

As a researcher from the Faculty of Science you might process personal data within the framework of academic research. This requires that you work in accordance with current regulations and legislations, respecting research subjects’ privacy.

All projects at the Faculty of Science that process personal data must demonstrate compliance with the General Data Protection Regulation (GDPR – or AVG in Dutch).

In order to know whether and how you should comply with the GDPR in your research project, is important to understand whether you are working with personal data and what are the actions needed to ensure data is protected.

What are personal data?

Would you like to read more about what is personal data and how to asses whether your data contains personal data? Go to the UU Data Privacy Handbook

What should I do If I process personal data?

Once you have determined that you will be processing personal data, it is important to  evaluate and document the GDPR compliance of your project. This will impact the way you manage data, as you will need to incorporate data protection measures across your data lifecycle. According to the characteristics of your project you may need to complete a Privacy Scan or a DPIA.

Drop-down image text

Image title: 10 steps towards privacy compliance in research
1. Keep the GDPR in mind when designing your research. Do you need to collect personal data, why and how much?

2. Make sure you have a legal basis to use personal data. E.g., public interest or consent.

3. Arrange ethics review. Ethics review makes sure that you have also taken ethical implications into account.

4. Document privacy related risks and privacy-related decisions. E.g., in a Data Management Plan, privacy scan or Data Protection Impact Assessment.

5. Inform participants properly. E.g., in an information letter, oral script, privacy statement.

6. Protect your data with organizational measures. E.g., access control agreements with external parties, data protection policies, researcher training.

7. Enable participants to exercise their rights. E.g., right to data access, correction, objection, erasure.

8. Protect your data with technical measures. E.g., anonymise, pseudonomyze, encrypt your data, use safe storage.

9. FAIR data: balance risks and Open Science principles. E.g., share under restricted access or only share metadata and materials.

10. Ask for help when you need it! Contact your privacy officer or data stewards for support

Data protection should be a key feature in the design of your research project so it is important to contact the faculty data stewards early on, preferably already in the conception or design phase of your research. We will help you review your plans and determine the appropriate strategies to protect the data so that you can conduct your research project smoothly.

Data Privacy Handbook and Privacy Basics course

The Data Privacy Handbook is a guide developed by RDM Support in collaboration with privacy and data experts at Utrecht University. It includes workflows, tools, and practical translations of the GDPR, to be used by researchers and (data) support staff within Utrecht University and beyond.

Go to the Data Privacy Handbook

You can now take the self-paced online module “Privacy Basics for Researchers”. Through interactive content and exercises, this e-learning module gives you an essential understanding of privacy principles and practices when dealing with personal data in research.

Go to the Privacy Basics for researchers module.

Submission to the ERB

Research projects involving processing of personal data from human subjects are expected to be submitted for assessment to the faculty Ethics Review Board. A data management plan and, where needed, a privacy review are required for submission. You can find out more about the Ethics Review process in their FAQ page.

For ICS researchers

Are you a researcher from Information and Computing Sciences? Then you can use the Ethics and Privacy Quick Scan from your research institute.

Do you have questions or doubts or would like to plan a 1 – 1 consultation?