Data Protection & Ethics

<style>

4

.dpe{max-width:1400px;margin:0 auto;color:#322f2b}

5

.dpe *{box-sizing:border-box}

6

.dpe-card{border:1px solid #e3ded6;border-radius:11px;background:#fcfbf8;box-shadow:0 1px 3px rgba(0,0,0,.035)}

7

.dpe-hero{height:132px;overflow:hidden;background:#f1eee9;border-radius:11px 11px 0 0}

8

.dpe-hero img{width:100%;height:100%;object-fit:cover;object-position:center 45%;display:block}

9

.dpe-eye{font-size:12px;font-weight:700;letter-spacing:.075em;text-transform:uppercase}

10

.dpe-sec{margin:0 0 27px 0}

11

.dpe-sec h3{font-size:22px;line-height:1.25;margin:0 0 7px;color:#35312d;text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}

12

.dpe-sec>p{color:#625d56;line-height:1.58;margin:0 0 13px}

13

.dpe-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(285px,1fr));gap:12px}

14

.dpe-grid-2{display:grid;grid-template-columns:repeat(2,minmax(300px,1fr));gap:12px}

15

.dpe-info{padding:15px 17px;border:1px solid #c7e5ed;border-left:5px solid #21b6d7;background:#eaf6f9;border-radius:8px;color:#365e68;line-height:1.5}

16

.dpe-info strong{color:#2d5661}

17

.dpe-protect{padding:15px 17px;border:1px solid #ecdba3;border-left:5px solid #f0aa00;background:#fff8e7;border-radius:8px;color:#675a35;line-height:1.5}

18

.dpe-protect strong{color:#705416}

19

.dpe-warn{padding:15px 17px;border:1px solid #efd9cc;border-left:5px solid #e94b13;background:#fff6f1;border-radius:8px;color:#67564e;line-height:1.5}

20

.dpe-warn strong{color:#744531}

21

.dpe-check{position:relative;padding:12px 13px 12px 37px;border:1px solid #e3ded6;border-radius:8px;background:#fffdf9;color:#504a44;line-height:1.5}

22

.dpe-check:before{content:"✓";position:absolute;left:13px;top:10px;color:#f0aa00;font-weight:800}

23

.dpe-step{position:relative;padding:13px 14px 13px 50px;border:1px solid #e3ded6;border-radius:8px;background:#fcfbf8;min-height:76px}

24

.dpe-step .n{position:absolute;left:13px;top:13px;width:26px;height:26px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#fff3d5;color:#765812;font-weight:800;font-size:12px}

25

.dpe-step h4{margin:0 0 4px;font-size:16px;line-height:1.3;color:#3b352e;text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}

26

.dpe-step p{margin:0;color:#625d56;line-height:1.45}

27

.dpe-scenario{padding:14px 15px;border:1px solid #e3ded6;border-top:4px solid #f0aa00;border-radius:9px;background:#fcfbf8}

28

.dpe-scenario h4{margin:0 0 6px;font-size:16px;color:#3e372e;text-align:left!important;word-spacing:normal!important}

29

.dpe-scenario p{margin:0;color:#625d56;line-height:1.5}

30

.dpe-table-wrap{overflow-x:auto;border:1px solid #e3ded6;border-radius:8px}

31

.dpe-table{width:100%;border-collapse:collapse;background:#fffdf9;min-width:920px}

32

.dpe-table th,.dpe-table td{padding:10px 11px;border-bottom:1px solid #e3ded6;vertical-align:top;text-align:left;line-height:1.4}

33

.dpe-table th{background:#f3efe8;color:#403b36;font-weight:700}

34

.dpe-table tr:last-child td{border-bottom:0}

35

.dpe-service-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:10px}

36

.dpe-service{display:block;padding:13px 14px;border:1px solid #e3ded6;border-left:4px solid #f0aa00;border-radius:8px;background:#fcfbf8;color:#2f2b27}

37

.dpe-service strong{display:block;margin-bottom:4px}

38

.dpe-service span{display:block;color:#625d56;line-height:1.45;font-weight:400}

39

.dpe-linkgrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:8px}

40

.dpe-navlink{display:block;padding:10px 11px;border:1px solid #e9e4dc;border-left:3px solid #f0aa00;border-radius:6px;background:#fffdf9;color:#252321;text-decoration:none;font-weight:600;line-height:1.35}

41

.dpe-navlink:hover,.dpe-navlink:focus{background:#fffaf0;text-decoration:none}

42

.dpe-resource-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px}

43

.dpe-resource{padding:15px 16px;background:#fcfbf8;border:1px solid #e3ded6;border-radius:9px}

44

.dpe-resource strong{display:block;color:#4c4130;margin-bottom:4px}

45

.dpe-badge{display:inline-block;margin:5px 0 7px;padding:4px 8px;border-radius:14px;background:#fff4ee;border:1px solid #efd9cc;color:#8a4d36;font-size:11px;font-weight:700;letter-spacing:.055em;line-height:1.2}

46

.dpe h1,.dpe h2,.dpe h3,.dpe h4,.dpe h5,.dpe h6,.dpe h1 a,.dpe h2 a,.dpe h3 a,.dpe h4 a,.dpe h5 a,.dpe h6 a{text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}

47

@media(max-width:850px){.dpe-grid-2,.dpe-resource-grid{grid-template-columns:1fr}}

48

@media(max-width:680px){.dpe-hero{height:105px}.dpe-sec h3{font-size:20px}}

</style>

</div>

<div class="dpe-eye" style="color:#7a5b12;margin-bottom:5px;">PREPARE · PROTECT & CLARIFY</div>

59

<h2 style="font-size:27px;line-height:1.2;margin:0 0 8px;color:#2c2926;">Identify personal, confidential and sensitive information early — and plan deliberately how it will be handled</h2>

60

61

Data protection, confidentiality, consent and ethical questions affect which information a project actually needs,

62

who may access it, how long it should be retained and what can later be shared or published.

63

Clarify these questions before collection, production or publication wherever possible.

</p>

</div>

</section>

<strong>Start from the actual information flow.</strong>

70

Record which personal, confidential or sensitive information is created or used,

71

who receives it, where it is stored and what should happen to it when the project ends.

</div>

<strong>Planning guidance — not a binding data-protection or ethics decision.</strong>

76

This page helps make questions visible early and document them.

77

Personal-data questions belong with the relevant data-protection service; ethical review follows the applicable project, funder or review route.

</div>

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">STEP 1 · CREATE A DATA-PROTECTION & ETHICS INVENTORY</div>

82

<h3>Record not only the information, but also its purpose, access and later use</h3>

83

<p>For each relevant material or information group, it should be clear why it is needed and how it will be handled.</p>

84

85

<div class="dpe-check"><strong>Information type:</strong> Which personal, confidential or sensitive information does the material contain?</div>

86

<div class="dpe-check"><strong>Necessity:</strong> Which of this information is actually needed for the project?</div>

87

<div class="dpe-check"><strong>People / participants:</strong> Who does the information come from and who is affected by it?</div>

88

<div class="dpe-check"><strong>Purpose:</strong> Why is the information collected, created, analysed or documented?</div>

89

<div class="dpe-check"><strong>Access:</strong> Who may access the information during the project?</div>

90

<div class="dpe-check"><strong>Storage:</strong> Where is the information stored and how is it appropriately protected?</div>

91

<div class="dpe-check"><strong>Retention / deletion:</strong> What should be retained, for how long, and what should later be deleted?</div>

92

<div class="dpe-check"><strong>Sharing / publication:</strong> Which content should remain internal, be shared with restrictions or become public?</div>

93

<div class="dpe-check"><strong>Consent / information:</strong> Which agreements or information for participants are required?</div>

94

<div class="dpe-check"><strong>Ethics or funder route:</strong> Is there an applicable review, approval or funder route that needs to be considered?</div>

</div>

</section>

<div class="dpe-eye" style="color:#7a5b12;margin-bottom:4px;">KEY DISTINCTIONS</div>

100

<h3>These decisions should be considered separately</h3>

101

102

<div class="dpe-protect"><strong>Participation ≠ publication.</strong><br>Agreement to participate in a project is not automatically the same as permission to make identifiable content public.</div>

103

<div class="dpe-protect"><strong>Legally compliant ≠ ethically unproblematic.</strong><br>Ethical questions can go beyond legal compliance and may require additional judgement.</div>

104

<div class="dpe-protect"><strong>Collection ≠ sharing.</strong><br>Information needed for project work does not automatically need to be distributed or published later.</div>

105

<div class="dpe-protect"><strong>Access during the project ≠ access after project closure.</strong><br>Decide who needs access during active work and what should be retained, restricted or deleted afterwards.</div>

106

<div class="dpe-protect"><strong>More data ≠ a better project.</strong><br>Check which personal or sensitive information is actually necessary before collecting or storing it.</div>

107

<div class="dpe-protect"><strong>Project coordination ≠ a data-protection decision.</strong><br>SKF can coordinate project and funder routes, but it is not the data-protection authority.</div>

</div>

</section>

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">STEP 2 · PRACTICAL WORKFLOW</div>

113

<h3>Make data protection and ethics part of the project workflow</h3>

114

115

<div class="dpe-step"><div class="n">01</div><h4>Clarify the information need</h4><p>Identify which personal, confidential or sensitive information the project genuinely requires.</p></div>

116

<div class="dpe-step"><div class="n">02</div><h4>Describe the information flow</h4><p>Record where information comes from, who receives it, where it is stored and how it may leave the project.</p></div>

117

<div class="dpe-step"><div class="n">03</div><h4>Assign responsibility</h4><p>Define who is responsible for decisions, documentation, access and specialist questions where needed.</p></div>

118

<div class="dpe-step"><div class="n">04</div><h4>Plan consent and participant information</h4><p>Where relevant, distinguish participation, documentation and publication of identifiable content.</p></div>

119

<div class="dpe-step"><div class="n">05</div><h4>Define storage and access</h4><p>Plan suitable storage, access restrictions and safeguards before collection or production begins.</p></div>

120

<div class="dpe-step"><div class="n">06</div><h4>Plan retention and deletion</h4><p>Decide which information is needed for how long and what should be deleted, restricted or retained after the project ends.</p></div>

121

<div class="dpe-step"><div class="n">07</div><h4>Plan specialist review in time</h4><p>Involve the data-protection service and the applicable ethics or funder route where the project requires it.</p></div>

122

<div class="dpe-step"><div class="n">08</div><h4>Recheck before publication</h4><p>Before sharing or publishing, confirm that the intended visibility matches the decisions already documented.</p></div>

</div>

</section>

<div class="dpe-eye" style="color:#7a5b12;margin-bottom:4px;">COMMON SCENARIOS</div>

128

<h3>In these project situations, clarify the information flow especially early</h3>

129

130

<div class="dpe-scenario"><h4>Interviews, conversations & portraits</h4><p>Keep participation, recording, internal analysis and possible publication of identifiable content clearly separate.</p></div>

131

<div class="dpe-scenario"><h4>Participatory & collaborative work</h4><p>Check which information about participants is created, who can see it and which later forms of presentation or publication are intended.</p></div>

132

<div class="dpe-scenario"><h4>Confidential or sensitive material</h4><p>Define access, storage, sharing, retention and deletion explicitly instead of leaving them to the general project workflow.</p></div>

133

<div class="dpe-scenario"><h4>External project partners</h4><p>Clarify which information moves between units, who is responsible and how handover or project closure will be handled.</p></div>

134

<div class="dpe-scenario"><h4>Public outputs</h4><p>Before a website, exhibition, publication or repository deposit, recheck which identifiable or sensitive information should actually become visible.</p></div>

135

<div class="dpe-scenario"><h4>Funded projects</h4><p>Include additional funder requirements, reporting obligations or applicable review routes in project planning.</p></div>

</div>

</section>

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">STEP 3 · DOCUMENT DECISIONS</div>

141

<h3>A simple data-protection & ethics log keeps decisions traceable</h3>

142

<p>The log can be part of the project folder, material inventory or data management plan. What matters is that responsibility, access, retention and planned sharing remain understandable.</p>

143

144

145

<thead><tr><th>Field</th><th>What to record</th><th>Why it matters</th></tr></thead>

146

<tbody>

147

<tr><td><strong>Material / information group</strong></td><td>A clear name for the data, documentation, recording or material group.</td><td>Connects decisions to the correct project material.</td></tr>

148

<tr><td><strong>Personal / sensitive content</strong></td><td>Which personal, confidential or sensitive information is contained.</td><td>Makes protection needs visible early.</td></tr>

149

<tr><td><strong>Purpose</strong></td><td>Why the information is needed, collected, created or retained.</td><td>Prevents unclear or unnecessary collection.</td></tr>

150

<tr><td><strong>Access</strong></td><td>Which people, roles or project partners may access it.</td><td>Makes responsibility and restrictions traceable.</td></tr>

151

<tr><td><strong>Storage</strong></td><td>Where the information is stored and who manages the storage location.</td><td>Connects protection requirements to the actual working environment.</td></tr>

152

<tr><td><strong>Consent / participant information</strong></td><td>Which participation, documentation or publication decisions have been recorded.</td><td>Keeps different uses distinct.</td></tr>

153

<tr><td><strong>Retention / deletion</strong></td><td>How long the information is needed and what happens at project closure.</td><td>Prevents accidental indefinite retention.</td></tr>

154

<tr><td><strong>Sharing / publication</strong></td><td>Whether and how content is used internally, with restrictions or publicly.</td><td>Connects active project work to later publication.</td></tr>

155

<tr><td><strong>Review</strong></td><td>Date or event for rechecking, such as publication or project closure.</td><td>Ensures changed project plans are reviewed again.</td></tr>

</tbody>

</table>

</div>

</section>

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">STOP & CHECK</div>

163

<h3>Common warning signs in data protection and ethics</h3>

164

165

<div class="dpe-warn"><strong>More personal information is collected than the project actually needs.</strong><br>The information requirement was not clarified before work began.</div>

166

<div class="dpe-warn"><strong>Participation and publication are treated as the same decision.</strong><br>Permission to participate does not automatically cover every later use of identifiable content.</div>

167

<div class="dpe-warn"><strong>Access rights are undefined.</strong><br>It is unclear who may see personal, confidential or sensitive information during the project.</div>

168

<div class="dpe-warn"><strong>Retention and deletion are unresolved.</strong><br>No one has decided what should be kept, restricted or deleted after project closure.</div>

169

<div class="dpe-warn"><strong>Public presentation is planned but has not been rechecked.</strong><br>Before publication, exhibition or online release, confirm which information should actually become visible.</div>

170

<div class="dpe-warn"><strong>Several units are involved but responsibilities are unclear.</strong><br>Project coordination, data-protection review and any applicable ethical review need distinct responsibilities.</div>

</div>

</section>

<div class="dpe-eye" style="color:#7a5b12;margin-bottom:4px;">SERVICES & SUPPORT</div>

176

<h3>Who is responsible for data-protection and ethics questions</h3>

177

178

179

<strong>Data Protection Officer / data-protection service</strong>

180

<span>Primary specialist responsibility for questions concerning personal data and data-protection review.</span>

181

</div>

182

183

<strong>Project / host unit</strong>

184

<span>For project-level responsibility, working arrangements and the organisational anchoring of decisions.</span>

185

</div>

186

187

<strong>Applicable ethics or funder route</strong>

188

<span>For ethical review or additional requirements where the specific project or funding context requires them.</span>

189

</div>

190

191

<strong>Support Kunst und Forschung (SKF)</strong>

192

<span>Coordinates project and funder requirements and helps route specialist review; SKF is not the data-protection authority.</span>

</div>

</div>

</section>

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">RELATED TOPICS</div>

199

<h3>Data-protection and ethics decisions are often connected to these topics</h3>

200

201

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Enable/Copyright%2C%20Rights%20%26%20Licences/">Copyright, Rights & Licences</a>

202

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Enable/Identify%20Your%20Data%20%26%20Research%20Outputs/">Identify Your Data & Research Outputs</a>

203

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Enable/Plan%20Your%20Data%20Management/">Plan Your Data Management</a>

204

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Work%20%26%20Manage/Store%2C%20Back%20Up%20%26%20Control%20Access/">Store, Back Up & Control Access</a>

205

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Publish%20%26%20Share/Decide%20What%20to%20Share/">Decide What to Share</a>

206

<a class="dpe-navlink" href="https://xwiki.uni-ak.ac.at/bin/view/Service%20Navigator/Art%20%26%20Research%20Services%20Navigator/Publish%20%26%20Share/Manage%20Access%2C%20Reuse%20%26%20Licensing/">Manage Access, Reuse & Licensing</a>

</div>

</section>

211

{{include reference="Service Navigator.Art & Research Services Navigator.Code.TrainingWorkshopsBlock" author="target" /}}

212

213

214

215

<div class="dpe-eye" style="color:#8a4d36;margin-bottom:4px;">PRACTICAL RESOURCES</div>

216

<h3>Info sheets, tutorials and templates</h3>

217

218

<div class="dpe-resource"><strong>Info Sheets</strong><span class="dpe-badge">COMING SOON</span><div style="color:#625d56;line-height:1.45;">Short guidance on personal data, confidentiality, consent and ethical project questions.</div></div>

219

<div class="dpe-resource"><strong>Tutorials</strong><span class="dpe-badge">COMING SOON</span><div style="color:#625d56;line-height:1.45;">Step-by-step workflows for information inventories, access planning, retention and publication checks.</div></div>

220

<div class="dpe-resource"><strong>Checklists & Templates</strong><span class="dpe-badge">COMING SOON</span><div style="color:#625d56;line-height:1.45;">Templates for a decision log, project review and handover.</div></div>

</div>

</section>

<strong>Need help finding the right route?</strong>

226

For questions concerning personal data, start with the data-protection service.

227

Where several units or funder requirements are involved, SKF can coordinate the project route and refer the question to the appropriate specialist review.

</div>

<summary style="cursor:pointer;color:#6a655e;font-size:13px;">Search terms & related topics</summary>

232

233

data protection · ethics · personal data · sensitive data · confidentiality · consent · participation · publication · identifiable content · access · access control · storage · retention · deletion · sharing · data management · research data · project documentation · Data Protection Officer · ethics review · funder requirements · project partners · publication · repository

</div>

</details>

</div>

Wiki source code of Data Protection & Ethics

Applications

Navigation

My Recent Modifications