Find out if my research is subject to GDPR

The General Data Privacy Regulation, or GDPR, is a privacy regulation in the European Union governing the collection and processing of personal data within the European Economic Area (EEA). While GDPR contracts and data use agreements can contain security clauses, it's important to remember that GDPR is largely a privacy regulation.

Directions

• Ask yourself the question: "Am I collecting information from subjects that are physically located in the European Economic Area (EEA)?"
  Note: subjects do not have be living in the EEA; they can be anyone physically present there, including travelers. 
  
  • If yes: the study is subject to the GDPR and at the very least this means you need to get consent from the subjects, but there are other requirements that you should be aware of.

Additional Resources

• Get assistance from the dedicated GDPR support group at IU that is run under the Chief Privacy Officer by contacting them at gdpr@iu.edu.
• More information about GDPR at IU can be found at the IU GDPR Working Group webpage.   
• Email securemyresearch@iu.edu for more help with security related GDPR clauses.

---

Related articles

• Page:
  Get help with cybersecurity in my data management plan
• Page:
  Find out if my research is subject to GDPR
• Page:
  Determine where to store my research data
• Page:
  Determine the IU data classification of my data
• Page:
  De-identify protected health information (PHI)