Designing your project

On this page: privacy by design, start early, preparation
Date of last review: 2022-10-31

Research projects typically go through a number of stages: conception, proposal, planning, execution, publishing, preservation, etc. If you work with personal data, you should think about how you will protect those data throughout all those stages. To do so, the concepts of Privacy by Design and Privacy by Default (art. 25) are important:

  • Privacy by Design in research means that your project integrates personal data protection right from the beginning, all the way throughout the project, and even afterwards. It should not be an afterthought: Privacy by Design is a key feature of the project, permeating all phases of a research project.
  • Privacy by Default in research means that any questions, tools, or methods you use in your research should process as little personal data as necessary by default, and that you share the personal data only with those who really need access.

To get proper support in designing your project, it is important to contact your privacy officer early on, preferably already in the conception or design phase. The privacy officer will help you go through the different stages smoothly, and eventually save you time and effort. They can help you review and possibly adjust your plans, determine the appropriate protection measures, and determine whether you need to perform a more elaborate Data Protection Impact Assessment.

The European Commission has created this interactive decision aid that can also help you think of all the necessary steps to design your project with personal data.

Privacy in the research cycle. From Conception (Hypothesis generation, ideas), to Designing the project (Grant/project proposal, Draft privacy scan, Consult with privacy officer, data manager, grant officer), to Grant/project approved (Privacy scan, possibly DPIA, Data Management Plan, Privacy notice and consent form, Ethics review, Agreements between parties) to Data acquisition (Data collection and reuse), Data Processing (Preprocessing, Analysis, Output generation), to Preservation (of data, code and documentation) and Publication (Manuscript, Data, Code and Documentation)