Skip to Content

Roles and responsibilities for processing personal data in scientific research

A research project can involve a variety of parties in different roles. Personal data may be processed for research purposes by one or more research organizations, persons in charge of the study, customers, researchers and other personnel. The roles of the various parties with regard to the processing of personal data and the controller’s responsibility must be defined clearly before the start of the study.

A controller is a person, company, authority or community that defines the purposes and methods of processing personal data. The controller is responsible for the lawfulness of the processing of personal data for the entire lifespan of the processing. The purpose of the definition is purpose is to allocate responsibility for compliance with data protection regulations where there is a genuine opportunity to influence the processing.

The controller for a research project is designated based on a case-by-case assessment. The controller can be an individual scientist, research team, research organisation or all the aforementioned together. The important thing is to define the responsibilities for the processing of personal data clearly from the beginning of the study to its end. Every participant in the research project must know their duties. No blind spots are acceptable in the processing of personal data.

This definition and any specific legislation applying to the research project that would influence choosing a controller for the processing activities need to be considered when designating the controller. For example, certain state research institutes have a statutory task to conduct research and have specific enactments that provide for their processing of personal data for these specific purposes. In international research, the designation of controller can also be influenced by national legislation.

Factors influencing the assignment of responsibility for processing

1. Is the research project and its purpose being planned by one party or several?

  • The controller alone determines the purposes and means of processing personal data.
  • If several parties act as joint controllers, they define the purposes and methods of personal data processing together and share the controller’s responsibility. They shall determine their respective responsibilities for compliance with the obligations under the GDPR in a transparent manner by means of an arrangement between them, as provided for in Article 26 of the GDPR. Duties regarding the exercise of the rights of data subjects and informing them must be divided clearly. The arrangement shall duly reflect the roles and relationships of the joint controllers in relation to data subjects. The essential information on how the responsibilities are divided must be made available to the data subjects.

2. Will the research organisation perform all processing itself, or will the implementation of the study require the purchase of external processing services?

  • A controller can commission services related to the processing of personal data from a processor. A processor is an individual or an organisation that processes personal data on behalf of a controller.  Processors operate according to the controller’s instructions and under its supervision. They do not have independent control over the data being processed, and they may only process the data as instructed by the controller. The controller determines the purposes and means of processing personal data.
  • The GDPR requires the processing carried out by a processor to be defined in an agreement or other binding legal document between the processor and controller. The agreement or document must confirm the subject, duration, nature and purpose of the processing, the type of personal data, the categories of data subjects and the obligations and rights of the controller. Article 28 of the GDPR contains more detailed provisions on the relationship of the controller and processor and on the terms to be included in the agreement.

The controller’s duties in research activities

It is essential to appoint a controller capable of performing the duties imposed on controllers and demonstrating compliance with data protection regulations in practice. 

The duties of the controller include ensuring that

Back to top