Data protection checklist: Research and Related Activities

Activities which involve processing personal data must comply with the general data protection regulation (GDPR). This checklist outlines the requirements of the GDPR and the measures you must take when processing personal data for research; it also provides a mechanism for recording the steps you will take to ensure the personal data you are using are safeguarded and the reputation of the University is upheld.

Ensuring personal data are processed fairly and lawfully with due regard for individuals’ privacy and ensuring that personal data remain secure are paramount. Demonstrating that we have considered the requirements of the GDPR when conducting our activities will provide assurances to research participants that their personal data is protected at Salford. Truly anonymised data (which cannot be reconstructed or linked to any other data you hold or may hold in the future to enable you to identify individuals from it) does not constitute personal data because it cannot be used to identify individuals. If you need any kind of assistance with data analysis dissertation help, then our team at Salford is there to support you throughout your research journey.

What is personal data?

Personal data are data relating to a living individual who can be identified from those data. Personal data can be factual (such as name, address, date of birth) or can be an opinion (such as a professional opinion as to the causes of an individual’s behavioural problems). Information can be personal data even if it does not include a person’s name or other obvious identifiers; for example, a paragraph describing a specific event involving an individual or a set of characteristics relating to a particular individual may not include their name but would clearly identify them from the set of circumstances or characteristics being described or represented.

What is processing?

The GDPR is concerned with the processing of personal data. Processing means obtaining, recording or holding the information or data or carrying out any operation or set of operations on the information or data, including –

(a) the organisation, adaptation or alteration of the information or data,

(b) retrieval or use of the information or data,

(c) disclosure of the information or data by transmission or otherwise making available.

If your proposed activity involves processing personal data, you must complete the following checklist.

If you are unable to answer Yes to each applicable question, you must contact the Information Governance Team for advice before proceeding. If you require any further information or guidance to enable you to answer Yes to each question, please contact the Information Governance Team

Processing personal data fairly

The GDPR requires us to process personal data fairly and lawfully. In practice and in the context of research, we must:

have legitimate grounds (this is our public task);

not use the data in ways that have unjustified adverse effects on the individuals concerned;

be transparent about how you intend to use the data, and give individuals appropriate privacy notices when collecting their personal data;

handle people’s personal data only in ways they would reasonably expect; and

make sure you do not do anything unlawful with the data.

Security

Ensuring personal data are secure at all times is extremely important. The GDPR requires us to ensure that appropriate technical and organisational measures shall be taken against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, personal data. It is important that any personal data you collect or use during your activities remains secure until it is destroyed, which includes ensuring that only those who are authorised to access and use the data can do so.

For further guidance on information security, please see IT Security and Information Governance

Once this form has been completed, it should be attached to your ethics application and submitted as directed. If your activity does not require further ethical approval, this form should be retained with your project documentation as a record of your considerations and data protection compliance.

You can find a variety of guidance documents and FAQs on the Information Governance web pages.