GDPR Information for Research

Where research involves using personal data, under the General Data Protection Regulation (GDPR) participants must be informed of the following:

the identity and contact details of the controller and the data protection officer
the purpose of the processing and the lawful basis for the processing
the categories of personal data that will be collected
the recipients of the personal data
details of any transfers to countries outside the European Economic Area (EEA) and safeguards
the retention period for the data
the participant's data rights
the contact details for lodging a complaint

The above information should be provided within the Participant Information Sheet

If you have any questions, or require further information, please contact rec-man@ncl.ac.uk.

Information for researchers

Under GDPR, as of 25th May 2018, you will need to ensure participants are provided with the information required under GDPR if you collect any new personal data, or if you process any personal data already collected.

New studies that were not submitted for ethical approval before 25 May 2018

You will need to ensure that the Participant Information Sheet(s) include the required information.

Studies approved before 25 May 2018 and where new participants are being recruited after 25 May 2018

You will need to provide new participants with the required information, either as a separate document or by updating the Participant Information Sheet. You should ensure that the separate document or the revised Participant Information Sheet is versioned and dated, and you should record that the amendment to the study document is non-substantial and non-notifiable.

Studies approved before 25 May 2018 and where existing participants are still in the study after 25 May 2018

As participants are still in the study, if personal data is still being collected, you should provide participants with the required information, as a separate document, when data is next collected from them, or sooner if possible.

Example information

Where Newcastle University is the sponsor, you should provide your participants with the following information, where this accurately represents how you are using personal data in your research study.

Where the information below does not accurately reflect how you are using personal data information, you will need to revise the information accordingly. Please contact res.policy@ncl.ac.uk for further information.

Newcastle University will be using information from you [and/or your medical records] in order to undertake this research study and will act as the data controller for this study. This means that Newcastle University is responsible for looking after your information and using it properly. When we use personally-identifiable information from people who have agreed to take part in research, we ensure that it is in the public interest. Your rights to access, change or move your information are limited, as Newcastle University needs to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, Newcastle University will keep the information about you that has already been obtained. To safeguard your rights, the minimum personally-identifiable information will be used. You can find out more about how Newcastle University uses your information at https://www.ncl.ac.uk/data.protection/dataprotectionpolicy/privacynotice/ and/or by contacting Newcastle University’s Data Protection Officer (Maureen Wilkinson, rec-man@ncl.ac.uk).

We will use your name and contact details [insert details applicable e.g. telephone number, address] to contact you about the research study. We will use [insert other identifiers e.g. date of birth] in order to [insert reason for processing]. Individuals at Newcastle University may look at your research data to check the accuracy of the research study. The only individuals at Newcastle University who will have access to information that identifies you will be individuals who need to contact you to [insert reason] or audit the data collection process.

If you agree to take part in the research study, information provided by you may be shared with researchers running other research studies at Newcastle University and in other organisations. These organisations may be universities, [and insert as applicable e.g. NHS organisations]. Your information will only be used by organisations and researchers to conduct research.

And

Either: This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose research, and cannot be used to contact you. It will not be used to make decisions about future services available to you.

OR: Your information could be used for research and could be combined with information about you from other sources held by researchers, the NHS or government. Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you. Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee.

Where the NHS is the sponsor, please see the HRA website for information and/or contact the Newcastle Joint Research Office.