GDPR: Can I share research data with personal data with other researchers or institutions when my research project has ended?

The GDPR does not prevent research data containing personal data from being shared with other researchers for reproducibility and reuse after the research.

What are the conditions for the reuse of personal data?

  • Sufficient technical and organizational measures must be taken such as pseudonymization, limitation of access to the data, encryption, ...
  • The principle of data minimisation must be respected (do not collect/process more personal data than necessary and do not transmit more personal data than necessary).
  • If the research goal of the reuse can be achieved with anonymous data, this is definitely preferred.
  • The purpose of the reuse must fall within the expectations of the data subjects.
  • When collecting data, explicit permission must be requested for the reuse of the data (see also this research tip).

If pseudonymised data are shared with third parties for the purpose of reproducibility or reuse, you must clearly describe in the GDPR register how this is done and what technical and organisational safeguards have been taken to protect the rights of the data subjects.

More tips

Translated tip

Last modified Aug. 28, 2023, 10:44 a.m.