Siirry sisältöön. | Siirry navigointiin

Jyväskylän yliopiston Koppa

HUOM! Kopan käyttö päättyy 31.7.2024! Lue lisää.


Personal data

tekijä: timapupu Viimeisin muutos torstai 14. maaliskuuta 2024, 12.44

This material is expired! Please go to the new and updated Research Data Management guide for students.


Are you doing research on human participants? Do your data include personal details? If your answer is yes, you must comply with the EU General Data Protection Regulation (GDPR) and Finland’s national Data Protection Act. Note that ‘processing’ here refers to all activities related to personal data, including their storing. 

According to the current interpretation, the author of a thesis is the ‘controller’ in the research, that is, responsible for processing personal data. In a research project where you work on your thesis as a member of the research team, the controller is often the University of Jyväskylä or some other research organisation. 

Recognise personal data  

The definition of ‘personal data’ is broad. Personal data include, for example:  

  • age 
  • educational background 
  • residential area 
  • photo 
  • voice 
  • fingerprints 
  • ethnic background or nationality  
  • marital status 
  • rare disease 
  • characteristic physical trait 
  • statements and opinions typical of a specific individual 
  • information on the participant’s circle of acquaintances or other parties 

Personal data include all the personal details that could reveal the research participant’s identity. The identification could be possible based on your research data or by combining your data with, for example, information on the internet.  Personal data are classified as direct identifiers, strong indirect identifiers, and indirect identifiers.  Direct identifiers such as names are clearly personal data. However, other kinds of details, traits, factors, activities and behaviours related to specific people can also be personal data. Read more about personal data and anonymisation.

The guidelines for processing personal data do not apply to deceased or fictional individuals.

When is a person identifiable?  

For example, if you mention an interviewee’s hometown and profession, the interviewee may be identified if the locality is small or the profession is uncommon.  

For instance, presidents would be too easily identifiable based on their profession. 

Do your data include special personal data?  

Special personal data include the following: 

  • ethnic origin  
  • political opinions  
  • religious or philosophical conviction  
  • labour union membership  
  • health-related information  
  • sexual orientation or behaviour  
  • genetic or biometric data to uniquely identify a person 

If your data include special personal data, it is particularly important to process them responsibly.  Take the following protective measures:  

  • Minimise data: data processing must be in due proportion to the objective of your research.  
  • Pseudonymisation is required always when possible for the research design.  More about this later!
  • Documentation of the processing of personal data: write down what you do, where the data are stored, and what you have agreed with the research participants. 

If this seems difficult, remember that privacy protection is not meant to prevent you from doing research. Its purpose is to protect the research participants. You as the thesis author are in charge of processing data responsibly.

Data security in online interviews

  • If it is necessary to do the interview remotely, use Zoom via the university. Use and log in with university credentials.
For intervies, use a recorder.

For surveys/questionnaires, use Webropol. If your data is sensitive (e.g. special personal data) surveys should be done with RedCap:

If the survey contains sensitive data such as special categories of personal data, use the JYU REDCap survey software instead of Webropol. REDCap is specifically intended for collecting sensitive personal information.
Order your REDCap user rights using a form in HelpJYU. On the form, mark "Studying" as the purpose of use. REDCap rights are then valid for the duration of your study right. The software makes it possible to build versatile online surveys and forms that can be used in field research (e.g. structured interview). Carefully familiarize yourself with the data security principles and functionalities of REDCap when you plan to implement a survey containing sensitive information. REDCap is quite versatile in its functionality and its user interface is in English, so you should start familiarizing yourself with it about 3-4 weeks before sending the survey.