This scenario shows how a researcher can respond to requests concerning personal data 

As a data controller in a research project, you may receive requests from data subjects, data processors, supervisory authorities (e.g., Data Protection Authorities), or even law enforcement (police, court). Here is how to handle these responsibly and lawfully: 

Step-by-step guide for researchers  #

1. Identify the source of the request  #

• Who made the request? 
• A data subject (the person the data is about) 
• The Data Processor  
• The Data Protection Authority (DPA) 
• A Law enforcement authority (police or court) 

2. Choose an appropriate method of communication  #

• You can respond via: 
• Written response 
• Electronic reply, if appropriate 
• Orally, if specifically requested by the data subject 

Make sure there is a security check to verify the identity of the requester. 

3. Determine which right is being exercised  #

Consider whether the request refers to the right of access or rectification or erasure or restriction of processing or data portability or objection (art. 15-21 GDPR).  

Each right has specific conditions under which it applies, and certain exemptions in the context of scientific research. 

4. Check for exemptions in scientific research  #

Some rights can be restricted or modified in research, if: 

• The research is carried out in the public interest 
• Complying with the request would seriously impair or make impossible the research objectives (Art. 89 GDPR) 
• Adequate safeguards (e.g., pseudonymisation, data minimisation) are in place 

Examples: 

• The right to erasure may not apply if deletion would prevent achieving the research goals. 
• The right to access may be limited, depending on the proportionality and sensitivity of the data. 

5. Respect the response timeline  #

• Respond within 1 month of receiving the request. 
• May extend by up to 2 additional months if justified (must inform the data subject of the reason for the delay). 

It is better to define the response period in a specific policy in advance. 

6. When you may refuse the request  #

• If the request is manifestly unfounded or excessive, you may: 
• Refuse to act (must explain why) 
• Or charge a reasonable fee (based on administrative costs) 

Even if denying the request, you must: 

• Inform the data subject of their right to lodge a complaint or seek judicial remedy 

Best practices  #

• Maintain records of all data requests and responses (GDPR Art. 30) 
• Keep your Data Protection Officer (DPO) informed 
• Ensure that your research project has an internal procedure for handling data rights