If you do not use personal data in your study, the GDPR does not apply. If (part of) your data does consist of personal data, you have to take measures. The type of data you use shall determine the kind of measures. The privacy expert in your organisation can tell you the exact measures based on your situation.
Broadly, three scenarios can be distinguished with regard to the type of data in research:
1. Automatically generated. This includes data originating from sources that make data available continuously, such as Wi-Fi networks, fitness watches, smart electricity meters etc. The communication of and access to these large volumes of automated data must be suitably secured (encryption, storage, https).
2. Own creation. This includes data originated through the efforts of the researcher, for instance: interviews, recordings, photographs taken etc. This often involves multiple data collection moments. Each moment and each process must be well considered with regard to security.
3. Re-use. This includes mostly multiple existing data sets that are linked together, or that are enriched by the researcher’s own data. Linking data sets may lead data to individuals. To prevent this, you have to ensure that access to the data is properly secured and that you immediately start using pseudonyms wherever possible.
A special category of personal data is the special personal data. These are data that refer directly to a certain person, such as DNA, photographs and video recordings, biometrical data etc. It often concerns data that can not or not easily be anonymised. For instance, in an interview you can leave out the name of the interviewee, so that the text is not traceable, but with DNA this is not possible.
If you are working with this type of data, you will have to take additional measures.
The specification of the measures you have to take in your study based on the scenario that is relevant to you is comparable with the steps in the ‘collaboration scenarios’. Performing a DPIA will give you insight in the measures to be taken.