Personal data in research at Aarhus University when we are the data controller

Personal data is any type of information that can be attributed to a specific person, even if the person can only be identified if the data is combined with other information.

For example, personal data can be civil registration numbers, registration numbers, a picture, a fingerprint, a voice, patient records or biological material. Personal data can be sensitive and non-sensitive. Read more about the definitions on the Danish Data Protection Authority's website. (In Danish only)

In research, studies and analyses based on personal data are crucial for developing solutions and research breakthroughs that can contribute to a sustainable society. Examples include disease prevention, treatments, climate, welfare, well-being, economy and much more.

Information comes from different sources when Aarhus University processes personal data for research. We can receive personal data in two ways:

• Directly from you, e.g. through a questionnaire, an interview, observations, etc.
• From others than you, e.g. from a municipality, a company, public registers etc.

You will find that Aarhus University often obtains information directly from you and combine this with information we receive from others.

Sharing knowledge is essential for research, and researchers collaborate across disciplines, universities and national borders. We make sure that we only share your personal data on a legal basis. If business partners are located outside the EU/EEA, we make sure to establish a transfer basis that guarantees your rights (in relation to the protection of your personal data), essentially corresponding to your rights within the EU/EEA.  

We process your personal data as long as is necessary to achieve one or more research purposes. We are obligated to store research data, including personal data, for at least five years after the latest research publication in order to document the integrity of the research.

Protection of your personal data is important and, among other things, it involves secure systems, restriction of access and requirements for the individual researcher. As the data controller, Aarhus University is obligated to comply with all the rules in the General Data Protection Regulation (GDPR), the Data Protection Act and other special rules on the processing of personal data.

All processing of personal data is also in accordance with our information security policy and our research instructions. Examples include:

Personal information to which researchers gain access via public registers is generally pseudonymised (i.e. it does not contain name, civil registration number or other information that can be linked directly to you). If researchers themselves collect personal data, they are obligated to pseudonymise the data themselves to the extent that this does not obstruct the research.

When your personal data is used for research purposes, you generally have the following rights:

• The right to have your personal data erased. However, not in cases where the erasure will make research impossible or will seriously obstruct the research.
• Right to have us notify recipients if we receive a request for rectification, limitation in the processing of personal data or erasure. This may be other research institutions to which the information has been disclosed in connection with a research project.

If you want to complain about the processing of your personal data, you can do so via the Danish Data Protection Authority's website, where there are also instructions on how to complain.