The definition of personal data is broad under the General Data Protection Regulation of the European Union (GDPR, 2016/679).
Personal data means any information relating to an identified or identifiable natural person (data subject). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiers can be:
The following personal data are defined as special categories of personal data (sensitive personal data) by the GDPR (Art. 9-10):
More information about what constitutes personal data, see:
Personal data shall be processed lawfully, fairly, and in a transparent manner to protect the fundamental rights and freedoms of the data subjects.
If you collect and process any information from individuals or about individuals (e.g., consumers, company managers), assume that it is personal data, and follow the seven procedures below to maintain high ethical standards and comply with relevant data protection legislation:
(1) Before data collection (during research planning phase)
2. Evaluate risks to data subjects
2.1 Request an ethical review statement when needed
2.2 Carry out a Data protection impact assessment (DPIA) when needed
(2) Data collection and analysis (during active research phase)
3. Specify the legal basis and provide privacy notice
4. Ensure secure data storage, backup, and transfers
5. Inform data subjects of changes and update documentation
6. Anonymize data prior to publishing and archiving
(3) After active research phase
(1) Before data collection (during research planning phase)
If your research proposal involves the processing of any personal data, you shall have plans in place to demonstrate compliance with EU and national data protection laws for the entire data life cycle.
At the earliest stage of designing your research project, consider how you design your study so that your data can be the least identifiable while still accomplishing your research goals, and ensure that, by default, personal data will be processed with the highest privacy protection. These are called data protection by design and by default principles.
Understand the objectives of your study and define the clear, specified need for collecting personal data. Collect only the minimum amount of personal data necessary and proportionate to the accomplishment of your research tasks. Personal data shall not be collected just in case that they might be useful in the future.
Conduct a data minimisation review for the whole process of data management, including defining the types and amount of personal data collected, the extent to which they may be accessed, further processed and shared, the purposes for which they are used, and the period during which they are kept. You shall minimise the processing as far as possible.
2.1 Request an ethical review statement when needed
All research shall comply with relevant Ethical principles and guidelines and follow any applicable ethical review practices. Conduct an ethical self-assessment and identify and address ethics issues in your research proposal.
Please contact Hanken’s Research Integrity Advisor (anu.helkkula@hanken.fi) for advice.
More information: To identify ethics and data protection issues in your research project, you can read Ethics and data protection (by the EC for scientific community, especially for funding applicants) and try its Ethics and Data Protection Decision Tree.
2.2 Carry out a Data protection impact assessment (DPIA) when needed
If a planned personal data processing is likely to result in a high risk to the rights and freedoms of the data subjects, a Data protection impact assessment (DPIA) shall be conducted prior to the processing. This may occur when the following data will be processed:
More information, see the nine criteria in the Guidelines on Data Protection Impact Assessment (DPIA) and determining whether processing is “likely to result in a high risk” for the purposes of Regulation 2016/679 (the PDF file by the European Data Protection Board, pp.9-11). The Guidelines (pp.11-14) also present a longer list of scenarios in which a DPIA may or may not be necessary.
A processing meeting one or two of the criteria may require a DPIA to be carried out. A DPIA helps you identify and minimise the data protection risks of a project. The contents of a DPIA shall contain at least:
Depending on the nature and scope of your processing, you can conduct a full or light version of a DPIA. Use Hanken's DPIA template (for studies and research) to conduct a full version of DPIA, or answer directly to the four minimum required aspects for a DPIA.
Contact dataethics@hanken.fi to conduct a DPIA.
(2) Data collection and analysis (during active research phase)
Personal data shall be processed lawfully with at least one of the six legal bases defined by the GDPR (Art. 6): consent, contract, legal obligation, protection of vital interests, public interest or official authority, and legitimate interests. You need to rely on at least one legal basis to justify why you have the right to collect, store, and handle personal data.
For research work conducted by researchers including PhD students, the legal basis is usually scientific research carried out in the public interest.
When collecting personal data, what researchers need to do to comply with good data management practices, data protection regulations, and research integrity includes:
Note that this consent (to participate in the research, required by ethical standards) is different from consent (to personal data processing, as a legal basis under the GDPR). The difference is acknowledged by TENK’s guidelines (p. 9).
If you do not ask for informed consent from the research participants, or if your study is one of the other five types described in Ethical review, you need to request for an ethical review statement by Hanken’s Research Ethics Committee.
(2) Provide privacy notice to research participants about the processing of their personal data. The GDPR (Art. 12-14) stipulates long lists of information that shall be provided to the data subjects, including the purposes and legal basis for processing, identity and contact details of the data controller and DPO, recipients of personal data, international data transfers, data retention and deletion plans, and data subjects’ rights.
For studies and thesis-writing by BSc/MSc/eMBA students, consent is usually used as the legal basis, unless the student is a member of a research project where one or more researchers (at the PhD level or above) are involved. When consent is used as a legal basis for processing personal data, the consent needs to meet the requirements of the GDPR. Consent to the processing of personal data should be a “freely given, specific, informed and unambiguous indication of the data subject’s wishes,” and “be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language” (GDPR, Art. 4 and 7). Data subjects have the right to withdraw their consent at any time. See Consent of the data subject by the Office of the Data Protection Ombudsman.
When collecting personal data, what students need to do to comply with data protection laws includes:
Special categories of personal data (sensitive personal data) are subject to specific processing conditions. Students and researchers need to rely on at least one of the ten exceptions or derogations to the prohibition in order to collect and process special categories of personal data:
A Data protection impact assessment (DPIA) may be needed when students and researchers process special categories of personal data, data of a highly personal nature, and other specially protected personal data . See the instructions under "2.2 Carry out a data protection impact assessment (DPIA) when needed" and contact dataethics@hanken.fi.
For secure storage and backup of active research data during usage, students and researchers use:
In addition to Hanken's and CSC's data storage systems, you can use your own password-protected personal computer and hardware (e.g., internal/external hard drives) and password-protected joint-use computers in a room located physically at Hanken with restricted access, to store and process data during research.
Unless you have entered into a Data processing agreement (DPA) with another system/service provider who acts as a data processor, you shall NOT use other systems and internet clouds, for example, iCloud, Dropbox, Google Docs, publicly available OneDrive (for consumers) and other survey platforms than Webropol. A Data processing agreement (DPA) shall be signed between the data controller and data processor. Hanken’s DPA templates are available here (Data Processing Agreement template and Data Processing Appendix template (as part of an Agreement)).
If you transfer personal data outside Hanken:
If you save and store your data in IDA by CSC, use the safe data transfer and sharing measures offered by IDA. See 1.8 I want to share my research data, what should I do? in FAQ of the Fairdata services by CSC.
You can use physical memory sticks or external hard drives, in cases where you or the other party do not have access to Hanken's data sharing systems. Make sure that data are stored securely, and that you erase the personal data stored on your memory sticks and on your USB disks immediately after the transfer. You can encrypt the data on memory sticks and external hard drives.
Note that you should NOT send or share data by an ordinary, non-secured email, or use systems that are not provided by Hanken or CSC, e.g., DropBox, Google Docs, and publicly available OneDrive (for consumers), for data transfers.
If you have a third party outside Hanken as the data processor who provides, for example, translation/interpretation, transliteration/transcription or raw data analysis services, you need to sign a Data processing agreement (DPA) with the data processor. Hanken’s DPA templates are available here (Data Processing Agreement template and Data Processing Appendix template (as part of an Agreement)).
For data transferred outside the EU/EEA, follow the European Commission's Rules on international data transfers (GDPR, Art. 44-50):
If personal data are transferred to non-EU/EEA countries, specify the countries' names in your privacy notice and the appropriate safeguards you plan to take to ensure that the level of data protection in compliance with the GDPR is not undermined. Contact dataethics@hanken.fi for advice, for example, conducting a Transfer impact assessment (TIA).
More information, see Transfers of personal data out of the European Economic Area by the Office of the Data Protection Ombudsman.
If you work with sensitive personal data, use CSC's Sensitive Data Services for Research including Sensitive Data Connect (SD Connect, for sensitive data storage and sharing) and Sensitive Data Desktop (SD Desktop) which are designed to support secure sensitive data management through web-user interfaces accessible from the user's own computer.
Protect the data with strict access control and encryption if you work with sensitive personal data or confidential data such as trade secrets, politically sensitive information, information concerning national security, and data obtained in trust and confidence:
You can ask for advice from Hanken’s Information security officer (datasakerhetschef@hanken.fi) to ensure that your storage and transfer solutions meet data protection requirements.
If there are changes in personal data processing, for example, if there are new, compatible processing purposes other than the initial purpose, if there are new recipients of the personal data (e.g., new research partners or translation or transcription service providers), or if there is an addition of new data variables to the categories of personal data compiled into the dataset, the privacy notice and other documentation shall be updated and the research participants be informed of the changes prior to the new processing.
It is stated by the Office of the Data Protection Ombudsman on Minimisation of personal data in scientific research that "[a]nonymisation and pseudonymisation should be performed as soon as possible, for instance right after the data have been aggregated."
Pseudonymisation means the processing of personal data in such a manner that the personal data can no longer be attributed to the individual involved without the use of additional information. Pseudonymisation can be done by removing or replacing identifiers with pseudonyms, aliases or codes. The additional information on the original values and techniques used to create the pseudonyms or codes shall be kept organisationally and technically separately from the pseudonymised data to ensure that the personal data are not attributed to an identified or identifiable natural person. (GDPR, Art. 4 (5))
The data remain pseudonymous and personal as long as the additional identifying information exist. That is, pseudonymised data can be attributed to a natural person by the use of the additional information and are still personal data.
Pseudonymised data become anonymised when the separately kept identifying information used to create the pseudonyms or codes (e.g., decryption keys, codes, applications or techniques used to pseudonymise the data) has been irreversibly destroyed and cannot be linked to the pseudonymised data.
Anonymisation thus refers to the processing of personal data in a manner that the individual concerned cannot be re-identified. Anonymised data are no longer considered to constitute personal data and are not subject to the data protection regulations.
Completely anonymous data do not exist, but by using various techniques and tools and following well-executed procedures, you can achieve a result where individual persons cannot be identified with reasonable efforts based on your data, e.g., by combining different indirect identifiers in your data, or by combining your data with the information from other external sources.
The table by the FSD provides good tips for recognising direct, indirect, and strong indirect identifiers and how to anonymise research data by removing, changing or categorising these different identifiers.
In categorising background information, utilise existing social classifications such as those Classifications by Statistics Finland.
For special categories of personal data involving pseudonymisation or anonymisation, it may be necessary to conduct a Data protection impact assessment (DPIA). See 2.2 Carry out a Data protection impact assessment (DPIA) when needed and contact dataethics@hanken.fi.
(3) After active research phase
Personal data that are no longer needed for the original purpose should be disposed as soon as possible unless there are special reasons or legislation that require archiving. Storage limitation reduces the risks related to personal data processing. If it is not possible to determine the exact data retention period, specify the criteria used to determine that period to your research participants.
Deleting files using operating system tools, or even reformatting a hard drive, will not irretrievably destroy the data. Save your files to OneDrive and use the deletion feature. Remember to empty the trash as well. Data in Webropol will be erased by the IT services shortly after a student's user ID is inactivated. You can ask for help and support from Hanken’s Information security officer (datasakerhetschef@hanken.fi) for secure data disposal measures.
More information, see:
Anonymised data are published and archived in a data repository for shared reuse whenever possible. According to Data Protection Act (1050/2018, Section 4 (4) and GDPR (point (e) of Art. 6 (1), if archiving research material containing personal data is necessary and proportionate to the aim of public interest pursued and to the rights of the data subject, it is lawful. Pseudonymised data are still personal data. Restricted access can be used as a measure to archive pseudonymised data. The research participants need to be informed of your open data plans in the privacy notice.
If the open accessibility of a dataset is not possible for justified reasons, the metadata of the dataset can be published openly available. It is strongly recommended to use Fairdata Qvain metadata tool to describe and publish your (meta)data. See Data publishing and preservation.
Data processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
Data controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means (i.e., why and how) of the processing of personal data. The controller is primarily responsible for compliance with data protection laws throughout the data life cycle. The controller can allocate responsibilities according to the actual roles of the parties.
Data processor means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the controller. A Data processor does not determine the purposes and means (i.e., why and how) of the processing of personal data. If your research project has a third party outside Hanken as a data processor who provides, for example, IT solutions for data collection or storage, translation/interpretation, transliteration/transcription or raw data analysis services, you need to sign a Data processing agreement (DPA) with the data processor. Hanken’s DPA templates are available here (Data Processing Agreement template and Data Processing Appendix template (as part of an Agreement)).
More information, see:
All research carried out in Finland shall comply with the guidelines by the Finnish National Board on Research Integrity (TENK): The Finnish Code of Conduct for Research Integrity and Procedures for Handling Alleged Violations of Research Integrity in Finland 2023 (the PDF file in English, Finnish, and Swedish). The Implementation checklist for the 2023 RI guidelines helps the leadership of an organisation, research leaders, and individual researchers ensure that the main practices of research integrity are followed.
In addition to the RI guidelines, TENK has issued the guidelines on the ethical principles to be followed as well as ethical review to be arranged for research in the humanities and social and behavioural sciences: The ethical principles of research with human participants and ethical review in the human sciences in Finland (2019, in English, Finnish, and Swedish):
When engaging in international collaboration, researchers shall follow the European Code of Conduct for Research Integrity (2023) by ALLEA, the European Federation of Academies of Sciences and Humanities, and any other applicable ethical guidelines.
Researchers shall bear the responsibility for ethical and moral concerns and decisions involved in the research and during the interaction between the researchers and research participants. Follow all the applicable ethical guidelines and good data protection practices to maintain high ethical standards and comply with relevant data protection legislation. See the section above on the Guidelines and procedures of personal data processing in research and studies at Hanken.
If you have questions concerning ethical guidelines and ethical review, contact Hanken's Research Integrity Advisor (anu.helkkula@hanken.fi).
If your study is one of these six types, you need to fill in the ethical review request e-form and submit to Hanken’s Research Ethics Committee:
When you submit your ethical review request, you always need to provide these attachments: a privacy notice and a consent form. Depending on your research, you may also need additional attachments, such as a Data management plan (DMP) where you indicate the date of your ethical review request, and/or a Data protection impact assessment (DPIA).
If you have questions concerning ethical review, please contact Hanken's Research Integrity Advisor (anu.helkkula@hanken.fi).
Watch the video TENK's Ethical review in human sciences:
Video: Ethical review in the human sciences in Finland, by TENK.
Legal issues related to data management include data protection laws, data-sharing agreements, data ownership, open data licenses, secondary data usage copyright permissions and other intellectual property rights (IPRs).
Agreements on data ownership and other IPRs shall be concluded before commencing any actual research activities. Agreements about authorship also need to be done before the beginning of the project.
Describe in your DMP how you agree upon the rights of use related to the research data your will collect, produce, and reuse for your research project. Clarify the transfer of rights procedures relevant to your project. Follow the funder's or publisher's policies. If applicable, describe confidentiality issues in your project as well.
Use a license when opening your research data, code or software for shared reuse. Licensing your open research data means that you clearly define the reuse terms and possible restrictions to the future reuse of your data. This way, you are in control of who has rights to reuse the data, and how they can reuse your data. Use machine-readable licenses that follow international standards, preferably Creative Commons. Besides Creative Commons licences, there are also specific licensing models for research data.
More information, see: