As a student at Tilburg University, you may need to work with personal data for research projects that are part of your Bachelor’s or Master’s thesis or for courses you follow. Working with personal data can mean any action such as collecting, analyzing, handling, or using this type of data. If you use personal data, these have to be handled with care and comply with the rules of the European 'General Data Protection Regulation'.
Personal data refers to all information directly or indirectly relating to a natural person. This includes directly identifiable information such as names and contact information. And also indirectly identifiable information such as gender, nationality and age. See the the University's Privacy & Security portal for more information on personal data, security and more!
You should take the following four basic rules into account when working with personal data:
I. Provide information and ask consent
When you conduct interviews or use questionnaires, you should provide your respondents or data subjects with all information about your research they need to decide on participation. Further, you need their permission (consent) for using the information they provide. Your respondents need to fill out or digitally agree to an information and consent form. In this form, you explain your research's purpose, why and how you collect personal data, that you will only use these data for your research, and who has access to the data. A checklist with elements that should be included in your information and consent form can be found on the next page. When using existing (secondary) personal data, be sure the organization providing the data can share the data. When collecting personal data without the involvement of the person(s) (for example by extracting data from websites or social media), you have to weigh the privacy rights of the person(s) and your own legitimate interest and make a balanced decision. Your thesis supervisor or teacher can help you with this.
2. Collect as little personal data as possible
Always ask yourself what personal data are necessary for your research. For example, do you really need to collect personal data that can be traced back to a natural person? Do you really need to make recordings? The less personal data you collect, the better. Once your research is finished and the data are no longer needed, delete all traceable data to individuals from your storage locations. The remaining anonymous data should be stored and accessible by your supervisor until your graduation.
3. Work securely: control access to your data
Make sure no one but you has access to the personal data. Store it safely, for example by pseudonymizing the data (i.e., removing or replacing identifying information), using encryption, or protecting your computer/USB stick with a strong password. Do NOT use your personal Google Drive, iCloud, Dropbox, Gmail, etc. for sharing and storing personal data. Instead, only use software and storage provided by the university, preferably TiU Google Drive. You cannot just use any software to collect or analyze personal data. You can use programs to analyze personal data on your own computer such as SPSS, R, Stata or Atlas.ti (in which case you are not sharing the data). For online surveys, you can use Qualtrics.
Some personal data are more sensitive than others. If you process any of the data from the following list, you also need to encrypt the data files using 7Zip or your storage device using BitLocker. You should treat these data with extra care and only use them when strictly necessary for your project.
Special categories of personal data (source: GDPR, Article 9):
- Racial or ethnic origin
- Political opinions
- Religious or philosophical beliefs
- Trade union membership
- Genetic and biometric information and all genetic data
- Information on health or natural person’s sex life or sexual orientation.
4. Do not include personal data in your thesis
When writing your thesis or paper, make sure not to include any personal data in it unless you have received explicit consent from the respondent for this (e.g., a quote from an interview). Always pseudonymize data and sources or use aggregated data so that no persons can be identified in your thesis. In some cases, using personal data in your paper is inevitable. In this case, only share your paper or thesis with your supervisor. Please note that most Master’s theses are sent to the university library for online publishing. If you do not want this, discuss this with your supervisor at an early stage.
See these rules in the Student research & personal data in your research handout.