The scientific research purposes exemption - publication - the Danish Data Protection Agency

Then remember to apply for authorisation from the Danish Data Protection Agency. You need to apply for authorisation from the Danish Data Protection Agency if your publication will include sensitive personal data. This applies even if you anonymise the personal data.

However, if you rely on a different legal basis, for example informed consent, you don’t need to apply for authorisation.

When is authorisation relevant?
Authorisation from the Danish Data Protection Agency is relevant if you intend to publish personal data in a recognised scientific journal or comparable publication, and the processing is carried out in accordance with Section 10 of the Danish data protection act. In this context, disclosure for publication is regarded as a special case, as the information may become available to a wider audience.

Why is this necessary?
When you use the scientific research purposes exemption as the legal basis for processing, the research subjects are not asked whether they wish to take part in the project. This is why you need to apply for authorisation for such projects if you want to publish special categories of personal data: it’s an additional protection for the research subjects.

Essentially, the rules are designed to ensure that you only disclose the information that is necessary, and that you do so in a responsible manner. You must be able to demonstrate that the journal is high-quality and explain how you have pseudonymised the personal data to be published. This is particularly true in the case of small populations, where even indirect information can make individuals identifiable.

How do you apply?
You start the process by filling out the form and sending it to the Research Data Office (use the email [email protected]). We’ll review the form and then and facilitate contact to the Danish Data Protection Agency. You can find the form and a brief introduction here.

If you transfer data to countries outside the EU/EEA, you must also have a valid legal basis for the transfer. Contact the TTO for assistance at [email protected]. The same applies to the disclosure of biological material processed under the scientific research purposes exemption.

Important to remember: You may not disclose the data before the authorisation has been granted. It takes 3-4 weeks to obtain authorisation from the Danish Data Protection Agency.