Data protection tools for researchers

1. In the research plan, define as accurately as possible the research question and the purpose for which personal data will be used.
2. Analyse which personal data is necessary to complete your research (amount and nature of data). Evaluate the necessity of processing personal data throughout the research and look for possibilities to minimise the processing of personal data in your research (e.g. pseudonymisation, anonymisation or erasure of the personal data).
3. Conduct a risk assessment and integrate necessary safety measures into the processing of personal data throughout the period in which the data is processed.
4. Plan in advance procedures in the event of different situations, such as breaches of personal data.
5. Identify the legal basis for processing personal data and, where necessary, update it according to the General Data Protection Regulation (e.g. consent).
6. Recognise the data subject’s rights associated with the legal basis for processing personal data and ensure that these rights are met.
7. Be prepared to demonstrate compliance of the data protection rules in your research with proper documentation, which proves that the data processing is in line the with the principles and other requirements of the General Data Protection Regulation.
8. Recognise your role and your responsibility! As a data controller, you are responsible for ensuring the lawfulness of the processing of personal data throughout the period in which the data is processed. If you need the services of other actors in processing personal data, enter into a written agreement and draw up clear instructions for the processing of the data.
9. Foster trust and safeguard the prerequisites for future research by complying with data protection legislation and ensuring transparency.
10. Data protection tools are an essential part of the researcher’s toolkit! Update your expertise and follow the website regularly: tietosuoja.fi/en/home

Download the list in PDF-format.

Raisa Leivonen is a Senior Adviser at the Office of the Data Protection Ombudsman.