How to handle personal data in a research project

Choose your legal basis for data processing

Before you begin data collection, you must select an appropriate legal basis for processing personal data. This will shape how you collect, use, and manage data throughout your project. There are two main options:

• Section 10 of the Danish Data Protection Act: This applies if your project serves the public interest and does not rely on consent.  When it comes to research, this may often be the more appropriate choice. This is also the case with research projects collecting REC consent - see FAQ.
• Article 6(1)(a) of the GDPR: This is used when you collect personal data based on consent from the participants.

When you register your project with SDU RIO, we will advise you on what legal basis is right for your research.

Inform participants and collect consent

You must inform participants about:

• Who is collecting the data
• What data is collected and why
• Which legal basis data is collected on
• How the data will be used and stored
• Their rights (e.g. access, deletion)

This must be done before or at the time of collection in clear and simple language for the targeted audience. 

Consent must be:

• Voluntary – no pressure or negative consequences
• Specific – for a clearly defined purpose
• Informed – participants must understand what they agree to
• Unambiguous – e.g. active opt-in, not silence

Consent can be withdrawn at any time. Note that consent should only be used when it is the most suitable legal basis.

If you need help preparing or reviewing an information form or consent form, please contact Legal Services at SDU RIO.

Store your data

You must only process and store personal data in systems approved by SDU, such as:

• SharePoint
• Nextcloud
• Ucloud

These systems are secure and meet the university’s data protection standards.

Share your data

Before you share data, you must consider the following questions:

1. Are you receiving data or giving data?
2. Is the transfer internal or external?

This is essential for the type of transfer form you will need to fill out.