Information Security

Dansk

 Information Security Data protection (GDPR) For scientific staff Legal basis and information duty Scientific research purposes

Scientific research purposes

The content on this page was updated in September 2021. Please note that we will be updating these pages continuously. 

Here you can find information about the scientific research purposes. You can use the scientific research purposes as legal basis if you only process personal data for scientific and statistical purposes where the processing of personal data is necessary for the research. 

Pursuant to the General Data Protection Regulation (information duty), you must provide the participants (also referred to as the data subjects) in your research project with information about how you will be processing their personal data. AU has two templates that you can use to meet your information duty. 

You can use these templates in situations in which your legal basis for processing personal data is that it is for 'scientific research purposes' (i.e. if you do not base your legal basis for processing on consent). Before processing personal data, you must determine whether Aarhus University is an independent data controller or a joint controller together with an external party.  

You can find a guide to fill out the information duty in the template.

If you are to disclose personal data based on the legal basis for scientific research purposes, please note that special rules apply to obtaining a disclosure declaration or, in some cases, permission from Danish Data Protection Agency.

The framework for scientific research purposes

SCOPE

Personal data may be processed if the processing takes place exclusively for scientific or statistical purposes, and if the processing is necessary for the research.

Please note that scientific research purposes cannot be used as a legal basis for the processing of personal data in an educational context.

CONDITIONS

Processing has to:  

  • take place within a recognised scientific field or for statistical purposes 
  • be necessary for the research

DOCUMENTATION REQUIREMENTS

You may be required to meet and document the information duty.  

A template is available to help you meet your information duty in research projects that use 'scientific research purpose' as the legal basis for processing personal data.  

Remember to save a copy of the document. 

PARTICIPANTS' (DATA SUBJECTS') RIGHTS

If your legal basis for processing personal data is 'scientific research purposes', many of your data subjects' rights can be derogated from. They can be derogated from because there are special exemptions for research and because there are special rules that protect the data subjects.  

DISCLOSURE OF DATA WITHIN THE EU/EEA (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You can disclose personal data for use in other research without the approval of the Danish Data Protection Agency within the EU/EEA by making a disclosure declaration.

You can use the AU form for this.   

DISCLOSURE OF DATA OUTSIDE THE EU/EEA (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You may only disclose personal data to a recipient outside the EU/EEA if you have received the Danish Data Protection Agency's approval to do so.  

See here for more information.    

DISCLOSURE OF BIOLOGICAL MATERIAL (NOTE: DOES NOT INCLUDE MAKING AVAILABLE TO DATA PROCESSOR)

You may only disclose personal data in the form of biological material for other research if you have received the Danish Data Protection Agency's approval to do so.  

See here for more information.

PUBLICING PERSONAL DATA

You may only disclose special categories (sensitive) of personal data with a view to publishing if you have received the Danish Data Protection Agency's approval to do so. Disclosure of general personal data with a view to publishing can take place if necessary, and the personal data is pseudonymised.     

See here for more information.

HOW TO REFER TO YOUR LEGAL BASIS

  • Processing of ordinary personal data: Article 6(1)(e) of the General Data Protection Regulation. 
  • Processing of sensitive personal data: Section 10 of the Danish Data Protection Act, cf. Article 6(1)(e) of the General Data Protection Regulation.

   

Do you need more help?

Contact TTO, if you have questions about the scientific research purposes.
Revised 06.02.2023
-
Webredaktionen, Universitetsledelsens Stab