Sensitive & Confidental Data

Sensitive Personal Data

Sensitive personal data may include information that could pose a greater risk to individuals if disclosed or misused, such as health information, biometric or genetic data, information about a person's private life, or other data requiring enhanced protection under applicable legislation.

Researchers should collect only the data necessary for the research, protect it appropriately, and ensure that processing is based on a valid legal and ethical basis.

Examples include:

• Medical and health information
• Genetic data
• Biometric data
• Information about political or religious beliefs
• Information about sexual orientation
• Interviews containing personal experiences
• Data relating to children
• Information about vulnerable populations
• Confidential commercial information
• Data covered by contractual restrictions

The General Data Protection Regulation (GDPR) is Regulation (EU) 2016/679 and provides the main framework for protecting personal data in the EU. The GDPR provides enhanced protection for certain types of personal data classified as “special categories of personal data” under Article 9. These categories are considered particularly sensitive because their processing may pose significant risks to individuals’ fundamental rights and freedoms. They include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, and trade-union membership, as well as genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, and data concerning a person’s sex life or sexual orientation.

Safeguarding Sensitive Data

Appropriate safeguards should be selected according to the type and sensitivity of the data. These may include:

• Data retention limits — Keep personal and sensitive data only for as long as necessary and in accordance with applicable legal, ethical, institutional, and funder requirements.
• Secure data transfer — Use secure methods when transferring data and avoid sending sensitive information through unsecured channels.
• Encryption — Encrypt sensitive data during storage and transfer where appropriate.
• Access controls — Limit access to authorised members of the research team and use appropriate authentication and permissions.
• Anonymization — Where possible, remove identifying information so that individuals cannot reasonably be identified. Where full anonymization is not possible, consider pseudonymization and appropriate additional safeguards.

Key Points for a Research Consent Form

A consent form should address:

• Purpose of the research
• What data will be collected
• How the data will be used
• Who will have access to the data
• Whether and how data will be shared
• How confidentiality and privacy will be protected
• How long the data will be retained
• Whether data will be anonymized or pseudonymized
• Participants' rights and how they can exercise them
• Contact information for questions or concerns

Copyright

Copyright may protect original research outputs such as publications, texts, photographs, illustrations, software, databases, and other creative works. Researchers should ensure that they have the necessary rights or permissions before making protected materials publicly available.

When using materials created by others, check the applicable licence or permission and provide appropriate attribution.

Intellectual Property (IP) Rights

Intellectual property rights may include copyright, patents, trademarks, database rights, and other rights associated with research outputs and inventions.

Researchers should consider:

• Who owns or holds the relevant rights
• Whether the research is subject to institutional or contractual arrangements
• Whether third-party materials are included
• Whether funder or collaboration agreements impose restrictions
• Whether an invention or other output may require protection before public disclosure
• Which licence or access conditions are appropriate for sharing