2.8 What should I think about when I collaborate with others or share my data?

Research data with personal data can  be  shared within your own institution with researchers within your own research project or with fellow researchers with whom you share data for further processing or reuse of the research data. It is important to document and motivate this transfer of data in the register. Also, do not forget to complete the register for each new processing by yourself or by fellow researchers within your own institution.

If the data is shared with people  outside your own institution  , it is often necessary to draw up a contract.  Based on the roles that these institutions or individuals play in the processing of personal data (see 2.4) during or after your investigation, a number of possible agreements are distinguished:

• If you collaborate with a processor within a research project or if you yourself assume the role of processor, a  processor  agreement must be drawn up. A processing agreement stipulates how the personal data can be processed, who has access and for what exact purpose they can be used.
• If, in addition to your own institution, another organization or institution is a controller (ie joint controller) you must record  (in an addendum to) the consortium agreement  who is responsible for providing information to the data subjects and for exercising the rights of those involved.
• When (personal) data is transferred between two institutions where the other party re-uses the data for its own purposes, a  data transfer agreement is  drawn up. Just like in a processor agreement, it is laid down how the personal data can be processed, who has access and for what exact purpose they can be used.
• If other researchers wish to reuse your data (which contain personal data) after your research, a  license or user agreement will be drawn up. These agreements clearly state the conditions under which your data can be reused.

In addition to the roles that the institutions and persons assume, the country in which these persons or institutions are located can also ensure that an agreement must be drawn up for the transfer of data. As the AVG only applies within the EEA, other countries generally do not offer an adequate level of protection (except if there is an adequacy decision). According to the AVG, transfer of personal data to these countries is therefore only possible with appropriate guarantees. Drawing up an agreement is one of the options here (see 2.7).   

It is important to mention that this usually concerns standard contracts drawn up by the European Commission. Hereby it is not allowed to make adjustments yourself.