• Intro
  • Data Privacy Handbook
    • How to use this Handbook
      • What are you looking for?
    • License and Citation
    • Disclaimer
    • Contributions
  • Privacy FAQs
    • General questions
    • Procedures and responsibilities
    • Informed consent
    • Legal questions
    • Storing personal data
    • Sharing, publishing and reusing personal data
    • Practical questions
    • Students and student data
    • Finding support
  • Knowledge Base
  • The GDPR
    • Chapter summary
    • What is the GDPR?
    • Definitions in the GDPR
    • Principles in the GDPR
    • Legal bases for working with personal data
      • Legal bases suitable for research
      • Legal bases not suitable for reseach
      • Further processing for research purposes
    • Data Subjects’ Rights
  • What are personal data?
    • Definition of personal data
    • How to assess whether data contain personal data?
    • Special types of personal data
      • Special categories of personal data
      • Data that are otherwise sensitive
  • Designing your project
    • Privacy by Design strategies
    • Data-oriented strategies
      • Minimise
      • Separate
      • Abstract
      • Hide
    • Process-oriented strategies
      • Inform
      • Control
      • Enforce
      • Demonstrate
  • Risk Assessment
    • How to assess privacy risks?
    • What are high-risk operations?
    • Classifying personal data
    • Examples of privacy risks and how to mitigate them
  • Documents & Assessments
    • Information to data subjects
      • When to use a privacy notice?
      • Content and examples of privacy notices
      • Form of a privacy notice
    • Informed consent
      • Consent step-by-step
      • Requirements for valid consent
      • What forms of consent are valid?
      • Demonstrating (valid) consent
      • Broad consent in research
      • Examples and templates
    • Privacy scan
      • When to use a privacy scan?
      • Examples and templates
    • Data Protection Impact Assessment
      • The process of performing a DPIA
      • Examples and templates
    • Legitimate interest assessment
      • How to do a legitimate interest assessment?
      • Examples and templates
    • Data Transfer Impact Assessment
      • What is a third-country transfer?
      • Goal and content of a DTA
      • Examples and templates
    • Processing register
    • Agreements
      • How to set up an agreement?
      • Non-disclosure agreement
      • Data processing agreement
      • Data Transfer Agreement
      • Joint controllers agreement
      • Data Use Agreement
      • Standard Contractual Clauses for international transfers
  • Techniques & Tools
  • Research scenarios
  • Pseudonymisation & Anonymisation
  • Statistical privacy
    • Statistical disclosure control
    • K-anonymity and its descendents
    • Differential privacy
  • Secure computing
  • Other techniques
    • Encryption
    • Synthetic Data
    • Data donation
  • Tools & Services
    • Utrecht University tool finders
    • Tools to deidentify, synthetise and work safely with personal data
    • Requirements for a third-party tool
      • 1. Who is processing the personal data: arrange an agreement
      • 2. Security level
  • Storage, Sharing, Publication
  • Storing personal data
    • Chapter summary
    • Where should I store personal data?
      • Storage media at UU
    • How should I store personal data?
    • For how long should I store personal data?
      • Deleting personal data
  • Sharing data with collaborators
  • Sharing data for reuse
    • Sharing anonymised data
    • Sharing personal data with a legal basis
      • 1. Be transparent
      • 2. Make sure you have a legal basis
      • 3. Protect the data while sharing
      • 4. Make your data FAIR
    • Alternatives to sharing personal data
      • Publish metadata and documentation
      • Use other techniques and strategies to enable reuse
  • Use Cases
  • Data minimisation in a survey
  • Data pseudonymisation
  • Publishing metadata
  • Reusing education data for research
  • Resources
  • Seeking help at Utrecht University
    • Education
    • Online information
    • In-person support
  • Glossary
  • Resources
  • Visit the GitHub repository

Data Privacy Handbook

Documents & Assessments

This chapter addresses privacy-related documentation that is most commonly used within research. For each type of documentation, it explains what it entails, when to use it, and how.

The following documents are addressed:

  • Information to data subjects
  • Informed consent forms
  • Privacy scan
  • Data Protection Impact Assessment
  • Legitimate interest assessment
  • Data Transfer Impact Assessment
  • The processing register
  • Several agreements, such as the non-disclosure agreement, data processing agreement, data transfer agreement, joint controller agreement, and data use agreement.

Utrecht University logo

Data Privacy Handbook

The information presented here is provided as is, with no guarantees of accuracy or completeness. For the most up-to-date information, please refer to your privacy officer, the university website or intranet. We cannot be held responsible for any negative consequences due to incorrect interpretation or use, and inconsistencies with policies/views of other institutions.

💡 Give feedback about this page