Data protection guidance and GDPR

Information for staff and students.

IOE staff

The Research Ethics Officer submits the ethics applications to the data protection office to obtain the mandatory data protection number for their research. 

Please ensure that you complete the data protection checklist before submitting your application.

Back to top

IOE postgraduate research students

Postgraduate research students are required to submit their IOE Ethics Application Form to data-protection@ucl.ac.uk in order to obtain a mandatory data protection number for their research, before the ethics review. Please follow the links below for more detailed information. 

Details on and forms for the student reviewing process for all postgraduate research students can be found here: 

For questions about information sheets: 

Back to top

Data protection requirements checklist

Please use this adapted template to certify that all data protection requirements have been addressed prior to submitting your ethics application form and supporting documents for review.

  1. Check to see if project is an extension of previous research and if so provide the research reference number
  2. Consent Form and Participant Information Sheet completed and provided including privacy notice
  3. Local project privacy notice is in place and contains the criteria set out in Articles 13/14 of GDPR – see "Where can I check that I have completed my Privacy Notice correctly?"
    1. Local project privacy notice links to one of the main UCL general research participant privacy notice
    2. Lawful basis for processing personal data is stated as 'performance of a task in the public interest' and special category or criminal convictions data is stated as 'research purposes'
  4. Appropriate safeguards are in place as per this guidance:
    1. Collect only the minimum amount of personal data required to carry out the research.
    2. Use pseudonymised personal data.
    3. Anonymise data where possible.
    4. Safeguards against accidental disclosure and loss or corruption of data.
    5. Ensure that the processing will not cause substantial damage or distress to individuals.
    6. Ensure that the processing will not be used to support measures or decisions with respect to a particular individual.
    7. Confirm evidence of the information security measures in place, e.g. encryption
  5. Ensure the terms anonymisation and pseudonymisation are used correctly in form
  6. The location of the data is specified, i.e.
    1. on UCL servers
    2. in the UK
    3. in the EEA
    4. outside the EEA.
  7. If personal data is stored outside the EEA, ensure that measures are in place to comply with data protection legislation.
  8. Indicate whether third parties, such as other universities or processors, are involved with processing or storage of data:
    1. If so, confirm data sharing/processing arrangements in place?
    2. If not, refer them to research services/contracts or procurement or solicitor in Legal Services.
  9. DPIA screening questions have been completed by staff if research deemed high risk. If so, the DPIA has been provided. Additional advice for projects meeting the threshold for conducting a DPIA can also be sought by contacting the UCL Data Protection team at data-protection@ucl.ac.uk.
  10. If the research involves children, the Research with Children Guidance has been followed.
  11. The information compliance training been undertaken within the last two years:
    1. Freedom of Information.
    2. Data protection.
    3. Information security.
  12. Provisions are in place around confidentiality, e.g. wording in participant information sheet.
  13. Data Protection Coordinator has been notified.

Back to top

General Data Protection Regulation (GDPR)

The GDPR affirms data protection's fundamental right and should be applied in a legitimate, effective, and consistent manner. 

While the GDPR does not sufficiently specify ethical standards, it is important that researchers understand what this means for the personal data that’s processed during your research projects.
 
The Data Protection Office (DPO) have issued guidance specifically aimed at researchers, managing individual research projects.
 
The DPO has also produced an extensive Frequently Asked Questions page for answers to the most common data protection queries.
 
For further details, including guidance for research with children on data protection issues, and examples of consent forms and information sheets with privacy notice links, please visit your relevant section (staff or students).
 
See further information and up-to-date guidance issued by the Information Commissioner’s Office.

Note: for ethics applications sent to the IOE REC for review, the IOE REC office will register the research with the Data protection office (DPO) and provide the researcher with a UCL data protection number. The DPO will then advise on any next steps if required.

GDPR-compliant exemplars for guidance

The consent forms and participant information sheets should be used as exemplars only. Researchers are expected to develop their own forms and information sheets as appropriate for their research and not reproduce or copy the examples as templates.

All information sheets developed for research must also include a link to the UCL general research participant privacy notice.

For questions about information sheets:

Back to top

Go to

Research with children