Collecting personal data

When collecting personal data, as a minimum, data subjects should be told:

  • who is collecting the personal data (e.g. name of department, research centre);
  • the purposes for which the personal data will be held;
  • any third parties the personal data may be disclosed to;
  • how long it will be retained.

A contact name, job position and telephone number should also be provided.

Prior consent should be obtained from data subjects to hold and process ("handle") their personal data and it is essential that such consent is obtained if the personal data is to be sent outside the European Economic Area and/or is sensitive data. Consent must be meaningful and freely given so it is important that individuals understand what will happen to their data.

Individuals should be given a plain language description of what will be done with their personal data and, where appropriate, a reassurance that individuals will not be disadvantaged if they choose to withdraw their personal data (for example, tell patients that if they withdraw from a clinical trial their medical data will be unaffected).