Do I have to notify my project?
The decisive factors for whether you must notify your project to NSD are:
- whether you are going to process personal data – and how you are going to process personal data, and
- whether you are a student or researcher at one of the institutions that have appointed NSD as their Data Protection Official for Research.
The procedure of notifying NSD is in agreement with the institutions.
What is personal data?
Personal data is information that can be used to identify individuals:
• directly through name, personal identification number, or other unique personal characteristics
• indirectly through a combination of background information such as place of residence or institutional affiliation, combined with data on age, gender, occupation, diagnosis, etc.
• by being traceable to an e-mail or IP address (e.g. online surveys)
• through a number referring to a list of names (scrambling key)
If you register anonymous information exclusively, the project is not subject to notification. Anonymous data contains no information that may identify an individual, neither directly nor indirectly, or through a list of names.
How will you process personal data in your project?
Processing personal data entails to collect, register, store and/or align and disclose personal data. You must notify your project if you will be processing personal data:
• using computer-based equipment (e.g. by processing text, audio or video files on a computer, USB or smartphone), and/or
• by manual storing of sensitive data sorted by name or personal identification number
You have to submit a Notification form even if you do not publish personal data
A project must be notified even if you only publish anonymous data. It is how you process personal data from the collection of data begins and until the results are published that determinates whether you have to submit a Notification form for your project.
You must submit the Notification form at least 30 days prior to commencing data collection.