If you need to process personal data for your research, it requires a legal basis for processing. In other words, this means that you must have a legal basis in the General Data Protection Regulation (GDPR) and, if relevant, the Data Protection Act or special legislation (i.e., other legislation than GDPR and the Danish Data Protection Act).
The legal basis on which you can base your processing of personal data depends on the processing you perform. When you process personal data for a research purpose, you can base your processing on one of the following forms of processing:
Please note that there may be other legal bases for some processing activities or there might be special requirements in special legislation. If necessary, contact your GDPR coordinator, if you are in doubt.
As a rule, you can choose freely between the legal bases. However, you must consider what legal basis is the most appropriate for the processing of personal data that is necessary for your purpose(s).
When you have determined the legal basis for your processing, please note that you cannot change the legal basis later.
Therefore, it is important that you, before you start processing of personal data, take a thorough approach to why and how you will process the personal data, as this may determine which legal basis is the most appropriate for you.
Below, we have compared the legal bases for scientific research purposes and a valid consent to data processing, so that you can get an overview.
Scope:
Personal data may be processed if the processing takes place exclusively for scientific or statistical purposes, and if the processing is necessary for the research.
Please note that scientific research purposes cannot be used as a legal basis for the processing of personal data in an educational context.
Conditions:
Valid consent to data processing has to:
Find more information about valid consent to data processing.
Documentation requirements:
You may be required to meet and document the information duty.
A template is available to help you meet your information duty in research projects that use 'scientific research purpose' as the legal basis for processing personal data.
Remember to save a copy of the document.
Documentation requirements:
Valid consent to data processing must be documented. Therefore, you should obtain written consent. You can use the AU consent form.
You also have to document that the data subjects have received the information required for the consent to be valid as well as the information required to meet the information duty. You can use the AU form to meet the information duty.
Data subjects’ rights:
If your legal basis for processing personal data is 'scientific research purposes', many of your data subjects' rights can be derogated from. They can be derogated from because there are special exemptions for research and because there are special rules that protect the data subjects.
Data subjects’ rights:
If your legal basis for processing personal data is a valid consent for data processing, many of your data subjects' rights can be derogated from. They can be derogated from because there are special exemptions for research and because there are special rules that protect the data subjects.
Remember that data subjects are entitled to withdraw their valid consent to data processing. This means that you must stop processing their personal data.
Disclosure of personal data:
Special rules apply when a disclosure is based on the legal basis for scientific research purposes.
As a rule, you must collect a declaration of disclosure from the recipient.
However, in three different cases you must obtain a permission from the Danish data protection agency, Datatilsynet, instead:
Disclosure of personal data:
You may only disclose personal data if you have the data subjects' valid consent to data processing to do so.
If you are disclosing personal data to a recipient outside the EU/EAA or an international organisation, there are special requirements for the information to be provided to the data subjects about the transfer and a legal basis for the transfer is needed.
Hopefully, the comparison above gives you an overview of what you should consider and be aware of before determining your legal basis for processing, but it may still be a good idea to familiarise yourself with the exact terms of the legal bases. You can find more information about legal bases by clicking on: