4.1 How can I be transparent to those involved in my research?

Informing the persons whose personal data are being processed is one of the basic principles of the GDPR ('transparency'). It is important here to communicate this information to those involved in a concise, transparent, comprehensible and easily accessible form and in clear and simple language.

The GDPR makes a distinction between situations where the personal data are collected from the data subjects themselves and when this data is not obtained from the data subjects themselves.

If you as a researcher collect personal data yourself, it is important to provide the following information to those involved:

• Contact details of the researcher / promoter (and the DPO of the institution)
• The purpose for which their personal data will be processed
• The legal basis for the processing of their personal data (see 2.2)
• If the processing is based on the legal basis 'legitimate interests': an argumentation of the legitimate interests of the controller
• If the processing is based on the legal basis 'consent': the statement that the data subject has the right to withdraw the consent at any time
• The persons or organizations with which the personal data will be shared
• Whether there will be a transfer of their personal data to a third country or an international organization. If a transfer takes place, it must be indicated what safeguards are being taken to protect the privacy of those involved (see 2.7)
• How long the personal data will be stored (see 5.1)
• What the rights of those involved are and how they can be exercised
• That those involved have the right to submit a complaint to the supervisory authority

If the personal data that you use in your research has not been obtained directly from the data subjects (ie for further processing, see 2.3), you must also provide the following information:

• The source where the personal data comes from
• If applicable: the existence of automated decision-making

If it is impossible for further processing of personal data or requires a disproportionate amount of effort to inform the data subjects, the GDPR allows the data subjects to not be informed directly. In this case it is important as a researcher to make efforts to make the information public in a different way. This can be done, for example, by a notice in a newspaper with a link to a website, the media, or a mention on the website of the project, the institution or via other common communication channels. The deviation from this requirement for providing information must be clearly justified in the register.