This scenario shows how a researcher who is leading a new project has to manage personal data.

Managing personal data responsibly is crucial in biomedical, health, or social science research. After preparing your project and defining the legal basis, here’s how to organize and handle personal data throughout the project lifecycle: 

1. Collect and document consent  #

If the legal basis for processing personal data is informed consent: 

• Ensure you have signed consent forms for: 
• Participation in the study 
• Processing of personal data, if required by law 

Consent must be specific, informed, and freely given, and it should also include information about data use, storage, and sharing. 

2. Capture and secure data  #

• Begin data collection according to your protocol. 
• Immediately pseudonymize personal data to protect identities: 
• Replace direct identifiers (names, IDs) with codes. 
• Store keys to these codes securely and separately. 

3. Store data in a secure research database  #

• Import data into a secure database or clinical data management system (CDMS). 
• Comply with your institution’s IT and data protection policies. 

4. Data sharing and collaboration  #

If you plan to share personal data with research partners: 

• Verify the partner’s identity and the purpose of the data use. 
• Ensure the use complies with the original legal basis (e.g., informed consent). 

5. Conclude a Data Transfer Agreement (DTA):  #

• Clearly define: 
• What data can be used 
• Who may access it 
• How it must be protected 

6. Anonymize or re-pseudonymize for export  #

If sharing data outside your institution: 

• Re-pseudonymize (generate new codes) or fully anonymize the dataset. 
• Conduct a risk assessment to evaluate re-identification potential. 

Only share data when privacy risks are acceptably low, and proper agreements are in place. 

7. Record keeping and logging  #

Maintain full records of processing: 

• What was shared, with whom, and why 
• Technical security measures used 
• Legal documentation (e.g., DTAs, consent forms) 

8. Prepare for the end of the project  #

At the end of the project, decide: 

• Do we need to retain the data (e.g., for reproducibility)? 
• Is the legal basis for retention still valid? 
• If consent expired, can we re-consent? 
• Otherwise, anonymize, archive, or securely delete the data. 

9. Ongoing monitoring and updating  #

Appoint a responsible person for data security and ensure: 

• Compliance with institutional rules (access control, logging, backup) 
• Continuous evaluation of anonymization and data protection technologies 

Regular updates to contact information for participants (where relevant)