5.2 Can I share research data with personal data with others when my research project has ended?

The GDPR does not prevent research data with personal data from being shared with other researchers for reproducibility and reuse after the research. The sharing of research data can only take place if there are sufficient safeguards for the protection of privacy (eg storage in a reliable repository that is certified with Data Seal or Approval or World Data System; with an agreement).

For ethical reasons, it is also important to ask in your informed consent whether the data subjects agree that their (pseudonymized) personal data is shared and to inform the data subjects of what safeguards are being taken to ensure their privacy. 

If pseudonymised data is shared with third parties for the purpose of reproducibility or reuse, the register of processing activities clearly describes how this is done and what technical and organizational safeguards have been taken to protect the rights of the data subjects.

Files with raw personal data are in principle not shared with third parties, unless this is justified for the purpose of reproduction, reuse or assessment of scientific integrity. The modalities of sharing this data will be clearly recorded internally in the register of processing activities. The agreements with the external party are laid down in an agreement (see also 2.8).