(re)search tips

News and practical tips for research, information management and scholarly communication

GDPR: how do I register personal data processing activities?

Why register processing activities?

The General Data Protection Regulation (GDPR) requires that all processing of personal data at Ghent University and Ghent University Hospital be documented and registered in a 'register of processing activities', the GDPR Register.
This internal documentation obligation is an essential tool for the researcher to meet his accountability.


When to register processing activities?

Whether you are acting as a controller or as a processor, you must register processing activities that take place under your responsibility.


New processing activities

The registration must be done for each new processing activity, i.e. at the beginning of each new research project in which you process personal data (or the phase in the project in which you process personal data), and even before the start of the actual collection/processing of the data.


Existing processing activities

You must also register existing processing activities. This concerns ongoing research projects, whether they started before or after 25 May 2018 (that is the date on which the GDPR came into force).


Updates

In addition, it is important to keep the information regarding the registered processing activities up-to-date during the duration of the research project.


Where and how to record processing activities?

As of 26 June 2026, as a Ghent University researcher, you must document and register your processing activities related to personal data via Responsum (and therefore no longer via DMPonline.be). In Responsum, Ghent University staff can register both the GDPR record and (if necessary) the Data Protection Impact Assessment (DPIA).  Existing GDPR records have been migrated by Ghent University to Responsum and can be consulted there. 


Researchers at Ghent University Hospital can still use DMPonline.be to create a GDPR record based on the GDPR Register template, which can be used to register the processing of personal data in research. The DPIA tab of such a plan allows you to document the DPIA if your project involves high-risk processing of personal data. In that case, you will be asked a series of questions that will help you further assess and document the risks.


Data management plans (DMP) can still be created via DMPonline.be tool. 


Keeping GDPR record up to date

Keep your GDPR record up-to-date in Responsum during the course of your research project. Via the 'My finalised GDPR records' tab, you can see a list of already created plans that you can then edit further. You can also find your old GDPR records that were previously created with DMPonline.be here. 

 

Need help? 

 

More information

More tips

Translated tip


tags:

Last modified June 24, 2026, 6:47 p.m.