Siirry sisältöön. | Siirry navigointiin

Jyväskylän yliopiston Koppa

HUOM! Kopan käyttö päättyy 31.7.2024! Lue lisää.


Familiarise yourself with the privacy notice

tekijä: timapupu Viimeisin muutos torstai 14. maaliskuuta 2024, 12.48

This material is expired! Please go to the new and updated Research Data Management guide for students.

As a rule, research participants are always entitled to know about the processing of their personal data. Agree with them on the use and sharing of their details. This is done using a privacy notice, notification and a consent form that supplements it. If you are a member of a research group, you do not necessarily do this yourself. 

The privacy notice is a template where you explain to each participant, for instance, what information will be collected, why, what will be done with the information, and how the information will be protected. The privacy notice is sent to the participants. The privacy notice is always required when personal data are processed. 

The reasons for processing personal data must be given. In your research plan, you describe the research design and research objectives. You must be able to justify collecting personal data based on them. Only collect personal data that you need to answer your research questions.

  • The processing of personal data must be appropriate, planned and justified, and there must be a legal basis for processing the data (e.g. consent from participants or research carried out in the public interest). Source
  • Sometimes interviewees tell more than they are asked. Such extra information should be deleted from the data (minimisation of personal data processing). 

A legal basis is needed for processing personal data, and it is specified in the privacy notice. In university research, the basis for processing is usually "research carried out in the public interest", in other words, "the processing of personal data for scientific research".  The legal basis for processing can also be consent from the research participant in some cases. For bachelor's thesis, the basis is consent. 

Watch the videos!

This video deals with the GDPR, the definition of personal data and the privacy notice, while also touching on anonymisation and pseudonymisation.

You will learn more about anonymisation and pseudonymisation on the next page. 

Consent forms 

Even when the legal basis for processing personal data is public interest, the participants are asked to give consent in order to have proof of consent to participate in the study.

No matter what, you should document consent. This can be done by having the participant sign the consent form, or recording a verbal consent in the interview recording or having the participant tick a box at the beginning of a survey to indicate consent.

Video 2 is about research participant rights and consent.

Parents’ consent is needed for participants younger than 15 years.   

What if I don’t intend to publish the personal data I receive? Is the privacy notice then needed? 
It is not important whether or not you publish the data. It matters that you process the data. 


Preliminary ethical review and impact assessment

 Ethical review before doing research on human participants 

You may need a preliminary ethical review for the harms and risks potentially caused to the research participants:  

In some situations, you may also need to make a data protection impact assessment (DPIA). 

Do not hesitate to ask JYU’s data protection officer for more information: