This scenario will take you step-by-step through the process of preparing a new project and how dealing with data.
Step 1 – Determine whether personal data will be processed #
The first step is to establish whether the project involves the processing of personal data.
- No personal data are processed → Data protection legislation (e.g. the GDPR) does not apply.
- Anonymised data only are processed (i.e. individuals are no longer identifiable) → the GDPR does not apply.
- Personal data or pseudonymised data are processed → the GDPR applies and the following steps should be undertaken.
Step 2 – Identify the type of data #
Determine which category of data will be processed.
Possible scenarios include:
- anonymous data;
- pseudonymised data;
- directly identifiable personal data.
The level of identifiability determines both the applicable legal framework and the necessary technical and organisational safeguards.
Step 3 – Define roles and responsibilities #
Clearly identify the role of each organisation involved in the project, especially in case of data-sharing or data transfers.
This includes determining whether an organisation acts as:
- Data Controller, determining the purposes and means of processing;
- Joint Controller, jointly determining purposes and means with another organisation;
- Data Processor, processing personal data on behalf of a controller.
Depending on their respective roles, appropriate agreements may include:
- Controller–Controller Agreement;
- Joint Controller Agreement;
- Data Processing Agreement (Controller–Processor);
- Consortium Agreement (for collaborative research projects).
Step 4 – Obtain ethical approval #
Before processing begins, submit the project to the competent Research Ethics Committee (REC) or Institutional Review Board (IRB) where required.
The ethics review should evaluate:
- scientific validity;
- ethical acceptability;
- proportionality;
- participant protection;
- use of biological samples;
- data protection arrangements;
- legal basis for processing.
Step 5 – Determine the source of the data #
Identify how the personal data will be obtained.
Possible situations include:
- prospective collection directly from participants;
- secondary use of existing datasets;
- receipt of data from another institution.
Step 6 – Assess compatibility for secondary use #
Where previously collected data will be reused for a new research purpose, assess whether the proposed secondary use is compatible with the original purpose of collection.
This assessment should consider:
- applicable legal provisions;
- participants’ expectations;
- original information provided;
- original consent, where consent constituted the legal basis;
- ethical approval.
If compatibility cannot be demonstrated, additional measures may be necessary, including obtaining new consent where feasible or redesigning the project.
Step 7 – Establish the legal basis for processing #
Identify the appropriate legal basis under the GDPR.
For special categories of data, such as health or genetic data, identify both:
- the legal basis under Article 6 GDPR, and
- the relevant condition under Article 9 GDPR.
Where applicable, national legislation governing scientific research should also be considered.
Step 8 – Prepare the required documentation #
Before commencing the research, prepare the essential governance documentation, including:
- research protocol or study design;
- participant information sheet;
- informed consent documents (where applicable);
- Data Management Plan;
- records of processing activities;
- data access policies;
- security measures;
- retention policies.
Step 9 – Conduct a Data Protection Impact Assessment (DPIA) #
Where processing is likely to result in a high risk to individuals’ rights and freedoms, conduct a Data Protection Impact Assessment (DPIA).
The DPIA should:
- describe the processing;
- assess necessity and proportionality;
- identify privacy risks;
- define mitigation measures;
- evaluate residual risks.
If the residual risk remains high despite mitigation measures, consultation with the competent supervisory authority may be required before processing begins.
Step 10 – Implement appropriate technical and organisational measures #
Appropriate safeguards should be implemented to ensure data protection throughout the project.
These may include:
- pseudonymisation or anonymisation;
- encryption;
- role-based access control;
- authentication procedures;
- secure storage;
- backup systems;
- cybersecurity measures, etc.
Step 11 – Assess international data transfers #
Where personal data are transferred across borders, determine whether the destination country provides an adequate level of protection.
Different scenarios apply:
- Transfers within the European Economic Area (EEA) or to countries benefiting from an European Commission adequacy decision may proceed without additional transfer authorisation, provided appropriate contractual arrangements are in place.
- Transfers to countries without an adequacy decision require appropriate safeguards under Chapter V GDPR, such as:
- Standard Contractual Clauses (SCCs);
- Binding Corporate Rules (BCRs);
- approved Codes of Conduct;
- approved Certification Mechanisms;
- other safeguards recognised under the GDPR.
Step 12 – Obtain final authorisation and begin processing #
Once all ethical, legal, organisational, and technical requirements have been satisfied, and all necessary approvals have been obtained, the research project may start.
Step 13 – Monitor compliance throughout the project #
Data protection compliance is an ongoing obligation. Researchers and institutions should ensure continued compliance with the GDPR and applicable national legislation through:
- review security measures;
- update the DPIA where necessary;
- monitor compliance with ethical approvals;
- document significant changes to processing activities;
- report and manage personal data breaches where required;
