Skip to Main Content

Research Data Management for Students: Personal data

Are you going to process personal data?

Any data than can be used to identify a person directly or indirectly are personal data. For example a name, an email address, and a picture or voice recording are personal data. As a general rule, you are always dealing with personal data when you process any data connected with living persons.

The University of Lapland advises that students avoid collecting personal data when it is not considered a necessary element by the supervisor. Personal data can be processed only with specific purposes and on an appropriate basis.

The university also recommends that special categories of personal data are not processed in theses. Special categories of personal data include for example racial or ethnic origin, political opinions, religion, health data, and sexual orientation. If you are planning to process special categories of personal data, contact our data protection officer and IT Security Manager together with your supervisor before collecting data.

Plan the processing of personal data carefully

Familiarize yourself carefully with the guidelines of Data protection in research in the University of Lapland. Always discuss collecting and processing personal data with your supervisor.

Pay close attention to at least these things:

  • Define the kinds of personal data you will process, how you process them, and for what purpose you process them. 
  • Avoid collecting unnecessary personal data.
  • Define the data controller of your research. If you are conducting research independently, you are also the data controller in your research. 
  • Plan where, how, and for how long you are going to securely store personal data and how you will protect it.
  • Inform the research participants about personal data processing. You can find the Privacy Notice template from the Data protection in research guidelines. Additional templates can be found in intra under the Legal Services. Your can study them together with your supervisor.
  • Define the basis for processing of personal data. 
  • Anonymize the data whenever possible.
  • Plan how you will take care of archiving or destroying your data. As a rule, you must destroy all personal data you have collected after your thesis is complete.
  • Make sure that the completed thesis does not contain unnecessary personal data. If you want to include them in the work, you must have permission to do so.
  • Always treat deceased subjects ethically and respectfully, even if the personal data regulation does not apply to their data. Note, that sometimes certain information about a deceased person can reveal something about living persons as well.

Do you need help?

Always discuss the processing of personal data and data protection with your supervisor first and foremost.

If necessary, you can together ask for help from the Data Protection Officer of the University of Lapland at tietosuoja(at)ulapland.fi

Do you need more information?

Check out the Data Protection Ombudsman's website Scientific research and data protection and the Finnish Social Science Data Archive's Data Management Guide.