Familiarise yourself with the privacy notice
You will find the necessary templates on the university website (e.g. privacy notice).
As a rule, research participants are always entitled to know about the processing of their personal data. Agree with them on the use and sharing of their details. This is done using a privacy notice, notification and a consent form that supplements it. If you are a member of a research group, you do not necessarily do this yourself.
The privacy notice is a template where you explain to each participant, for instance, what information will be collected, why, what will be done with the information, and how the information will be protected. The privacy notice is sent to the participants. The privacy notice is always required when personal data are processed.
The reasons for processing personal data must be given. In your research plan, you describe the research design and research objectives. You must be able to justify collecting personal data based on them. Only collect personal data that you need to answer your research questions.
- The processing of personal data must be appropriate, planned and justified, and there must be a legal basis for processing the data (e.g. consent from participants or research carried out in the public interest). Source
- Sometimes interviewees tell more than they are asked. Such extra information should be deleted from the data (minimisation of personal data processing).
A legal basis is needed for processing personal data, and it is specified in the privacy notice. In university research, the basis for processing is usually "research carried out in the public interest", in other words, "the processing of personal data for scientific research". The legal basis for processing can also be consent from the research participant in some cases. For bachelor's thesis, the basis is consent.
Watch the videos!
This video deals with the GDPR, the definition of personal data and the privacy notice, while also touching on anonymisation and pseudonymisation.
You will learn more about anonymisation and pseudonymisation on the next page.
Consent forms
Even when the legal basis for processing personal data is public interest, the participants are asked to give consent in order to have proof of consent to participate in the study.
No matter what, you should document consent. This can be done by having the participant sign the consent form, or recording a verbal consent in the interview recording or having the participant tick a box at the beginning of a survey to indicate consent.
Video 2 is about research participant rights and consent.
Parents’ consent is needed for participants younger than 15 years.
Example
What if I don’t intend to publish the personal data I receive? Is the privacy notice then needed?
It is not important whether or not you publish the data. It matters that you process the data.
Preliminary ethical review and impact assessment
Ethical review before doing research on human participants
You may need a preliminary ethical review for the harms and risks potentially caused to the research participants:
- Is ethical review necessary in your study? Before starting any practical actions in your study, submit a request for statement regarding an ethical review to the Human Sciences Ethics Committee.
- For research in health sciences, see also the website of the Ethics Committee of the Central Finland Health Care District (in Finnish only)
In some situations, you may also need to make a data protection impact assessment (DPIA).
Do not hesitate to ask JYU’s data protection officer for more information: tietosuoja@jyu.fi.