GDPR Information for Research

Under GDPR, as of 25th May 2018, you will need to ensure participants are provided with the information required under GDPR if you collect any new personal data, or if you process any personal data already collected.

New studies that were not submitted for ethical approval before 25 May 2018

You will need to ensure that the Participant Information Sheet(s) include the required information.    

Studies approved before 25 May 2018 and where new participants are being recruited after 25 May 2018

You will need to provide new participants with the required information, either as a separate document or by updating the Participant Information Sheet.  You should ensure that the separate document or the revised Participant Information Sheet is versioned and dated, and you should record that the amendment to the study document is non-substantial and non-notifiable.

Studies approved before 25 May 2018 and where existing participants are still in the study after 25 May 2018

As participants are still in the study, if personal data is still being collected, you should provide participants with the required information, as a separate document, when data is next collected from them, or sooner if possible.

Example information

Where Newcastle University is the sponsor, you should provide your participants with the following information, where this accurately represents how you are using personal data in your research study. 

Where the information below does not accurately reflect how you are using personal data information, you will need to revise the information accordingly.  Please contact res.policy@ncl.ac.uk for further information.

Newcastle University will be using information from you [and/or your medical records] in order to undertake this research study and will act as the data controller for this study.  This means that Newcastle University is responsible for looking after your information and using it properly. When we use personally-identifiable information from people who have agreed to take part in research, we ensure that it is in the public interest. Your rights to access, change or move your information are limited, as Newcastle University needs to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, Newcastle University will keep the information about you that has already been obtained.  To safeguard your rights, the minimum personally-identifiable information will be used. You can find out more about how Newcastle University uses your information at https://www.ncl.ac.uk/data.protection/dataprotectionpolicy/privacynotice/ and/or by contacting Newcastle University’s Data Protection Officer (Maureen Wilkinson, rec-man@ncl.ac.uk).  

We will use your name and contact details [insert details applicable e.g. telephone number, address] to contact you about the research study. We will use [insert other identifiers e.g. date of birth] in order to [insert reason for processing]. Individuals at Newcastle University may look at your research data to check the accuracy of the research study.  The only individuals at Newcastle University who will have access to information that identifies you will be individuals who need to contact you to [insert reason] or audit the data collection process. 

If you agree to take part in the research study, information provided by you may be shared with researchers running other research studies at Newcastle University and in other organisations. These organisations may be universities, [and insert as applicable e.g. NHS organisations].  Your information will only be used by organisations and researchers to conduct research. 

And

Either: This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose research, and cannot be used to contact you. It will not be used to make decisions about future services available to you.

OR: Your information could be used for research and could be combined with information about you from other sources held by researchers, the NHS or government. Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you.  Where there is a risk that you can be identified your data will only be used in research that has been independently reviewed by an ethics committee. 

Where the NHS is the sponsor, please see the HRA website for information and/or contact the Newcastle Joint Research Office.

As a university, we use personally-identifiable information to conduct research. When we use personally-identifiable information from people who have agreed to take part in research, we ensure that it is in the public interest. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Your right to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO).