GDPR Principles

#public

Managing and storing personal data in compliance with the GDPR (General Data Protection Regulation) requires careful consideration. Here are key steps and best practices to follow:

1. Data Minimization

Only collect personal data that is necessary for your research. In your case, names and contact information are essential for scheduling interviews.

2. Consent

Obtain explicit, informed consent from each participant. This means explaining:
Why you are collecting their data.
How it will be used.
How long it will be stored.
That they can withdraw their consent at any time.
The consent form should be clear and separate from other terms and conditions.

3. Data Protection and Privacy

Ensure that the data is stored securely.
Limit access to the data to only those who need it for the research.

4. Data Retention Policy

Specify how long you will keep the data. It should only be held for as long as necessary to fulfill the purpose of the research.
After this period, ensure that the data is securely deleted.

5. Rights of the Data Subjects

Inform participants of their rights under GDPR, including:
The right to access their personal data.
The right to correct inaccurate data.
The right to delete their data.
The right to restrict processing.
The right to data portability.

6. Data Processing Agreement

If you are using third parties to process personal data (e.g., cloud storage, transcription services), you need a Data Processing Agreement (DPA) to ensure they also comply with GDPR.

7. Data Protection Impact Assessment (DPIA)

If the research involves sensitive data or could significantly impact individuals, conducting a DPIA might be necessary. This helps identify and mitigate risks related to data processing.

8. Documentation

Keep detailed records of all the data processing activities, including consent forms, information about data collection, processing, and retention.

9. Notify the Data Protection Officer (DPO)

If your organization has a DPO, keep them informed about the project and ensure compliance with internal and GDPR guidelines.