Data Protection & Ethics
Version 6.3 by Veronika Kocher on Friday, 04 Sep 2026 14:45
.dpe{max-width:1400px;margin:0 auto;color:#322f2b}
.dpe *{box-sizing:border-box}
.dpe-card{border:1px solid #e3ded6;border-radius:11px;background:#fcfbf8;box-shadow:0 1px 3px rgba(0,0,0,.035)}
.dpe-hero{height:132px;overflow:hidden;background:#f1eee9;border-radius:11px 11px 0 0}
.dpe-hero img{width:100%;height:100%;object-fit:cover;object-position:center 45%;display:block}
.dpe-eye{font-size:12px;font-weight:700;letter-spacing:.075em;text-transform:uppercase}
.dpe-sec{margin:0 0 27px 0}
.dpe-sec h3{font-size:22px;line-height:1.25;margin:0 0 7px;color:#35312d;text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}
.dpe-sec>p{color:#625d56;line-height:1.58;margin:0 0 13px}
.dpe-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(285px,1fr));gap:12px}
.dpe-grid-2{display:grid;grid-template-columns:repeat(2,minmax(300px,1fr));gap:12px}
.dpe-info{padding:15px 17px;border:1px solid #c7e5ed;border-left:5px solid #21b6d7;background:#eaf6f9;border-radius:8px;color:#365e68;line-height:1.5}
.dpe-info strong{color:#2d5661}
.dpe-protect{padding:15px 17px;border:1px solid #ecdba3;border-left:5px solid #f0aa00;background:#fff8e7;border-radius:8px;color:#675a35;line-height:1.5}
.dpe-protect strong{color:#705416}
.dpe-warn{padding:15px 17px;border:1px solid #efd9cc;border-left:5px solid #e94b13;background:#fff6f1;border-radius:8px;color:#67564e;line-height:1.5}
.dpe-warn strong{color:#744531}
.dpe-check{position:relative;padding:12px 13px 12px 37px;border:1px solid #e3ded6;border-radius:8px;background:#fffdf9;color:#504a44;line-height:1.5}
.dpe-check:before{content:"✓";position:absolute;left:13px;top:10px;color:#f0aa00;font-weight:800}
.dpe-step{position:relative;padding:13px 14px 13px 50px;border:1px solid #e3ded6;border-radius:8px;background:#fcfbf8;min-height:76px}
.dpe-step .n{position:absolute;left:13px;top:13px;width:26px;height:26px;border-radius:50%;display:flex;align-items:center;justify-content:center;background:#fff3d5;color:#765812;font-weight:800;font-size:12px}
.dpe-step h4{margin:0 0 4px;font-size:16px;line-height:1.3;color:#3b352e;text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}
.dpe-step p{margin:0;color:#625d56;line-height:1.45}
.dpe-scenario{padding:14px 15px;border:1px solid #e3ded6;border-top:4px solid #f0aa00;border-radius:9px;background:#fcfbf8}
.dpe-scenario h4{margin:0 0 6px;font-size:16px;color:#3e372e;text-align:left!important;word-spacing:normal!important}
.dpe-scenario p{margin:0;color:#625d56;line-height:1.5}
.dpe-table-wrap{overflow-x:auto;border:1px solid #e3ded6;border-radius:8px}
.dpe-table{width:100%;border-collapse:collapse;background:#fffdf9;min-width:920px}
.dpe-table th,.dpe-table td{padding:10px 11px;border-bottom:1px solid #e3ded6;vertical-align:top;text-align:left;line-height:1.4}
.dpe-table th{background:#f3efe8;color:#403b36;font-weight:700}
.dpe-table tr:last-child td{border-bottom:0}
.dpe-service-grid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:10px}
.dpe-service{display:block;padding:13px 14px;border:1px solid #e3ded6;border-left:4px solid #f0aa00;border-radius:8px;background:#fcfbf8;color:#2f2b27}
.dpe-service strong{display:block;margin-bottom:4px}
.dpe-service span{display:block;color:#625d56;line-height:1.45;font-weight:400}
.dpe-linkgrid{display:grid;grid-template-columns:repeat(auto-fit,minmax(260px,1fr));gap:8px}
.dpe-navlink{display:block;padding:10px 11px;border:1px solid #e9e4dc;border-left:3px solid #f0aa00;border-radius:6px;background:#fffdf9;color:#252321;text-decoration:none;font-weight:600;line-height:1.35}
.dpe-navlink:hover,.dpe-navlink:focus{background:#fffaf0;text-decoration:none}
.dpe-resource-grid{display:grid;grid-template-columns:repeat(3,minmax(0,1fr));gap:12px}
.dpe-resource{padding:15px 16px;background:#fcfbf8;border:1px solid #e3ded6;border-radius:9px}
.dpe-resource strong{display:block;color:#4c4130;margin-bottom:4px}
.dpe-badge{display:inline-block;margin:5px 0 7px;padding:4px 8px;border-radius:14px;background:#fff4ee;border:1px solid #efd9cc;color:#8a4d36;font-size:11px;font-weight:700;letter-spacing:.055em;line-height:1.2}
.dpe h1,.dpe h2,.dpe h3,.dpe h4,.dpe h5,.dpe h6,.dpe h1 a,.dpe h2 a,.dpe h3 a,.dpe h4 a,.dpe h5 a,.dpe h6 a{text-align:left!important;text-align-last:left!important;text-justify:auto!important;word-spacing:normal!important}
@media(max-width:850px){.dpe-grid-2,.dpe-resource-grid{grid-template-columns:1fr}}
@media(max-width:680px){.dpe-hero{height:105px}.dpe-sec h3{font-size:20px}}
Start from the actual information flow.
Record which personal, confidential or sensitive information is created or used,
who receives it, where it is stored and what should happen to it when the project ends.
Planning guidance — not a binding data-protection or ethics decision.
This page helps make questions visible early and document them.
Personal-data questions belong with the relevant data-protection service; ethical review follows the applicable project, funder or review route.
STEP 1 · CREATE A DATA-PROTECTION & ETHICS INVENTORY
Record not only the information, but also its purpose, access and later use
For each relevant material or information group, it should be clear why it is needed and how it will be handled.
Information type: Which personal, confidential or sensitive information does the material contain?
Necessity: Which of this information is actually needed for the project?
People / participants: Who does the information come from and who is affected by it?
Purpose: Why is the information collected, created, analysed or documented?
Access: Who may access the information during the project?
Storage: Where is the information stored and how is it appropriately protected?
Retention / deletion: What should be retained, for how long, and what should later be deleted?
Sharing / publication: Which content should remain internal, be shared with restrictions or become public?
Consent / information: Which agreements or information for participants are required?
Ethics or funder route: Is there an applicable review, approval or funder route that needs to be considered?
KEY DISTINCTIONS
These decisions should be considered separately
Participation ≠ publication.
Agreement to participate in a project is not automatically the same as permission to make identifiable content public.
Agreement to participate in a project is not automatically the same as permission to make identifiable content public.
Legally compliant ≠ ethically unproblematic.
Ethical questions can go beyond legal compliance and may require additional judgement.
Ethical questions can go beyond legal compliance and may require additional judgement.
Collection ≠ sharing.
Information needed for project work does not automatically need to be distributed or published later.
Information needed for project work does not automatically need to be distributed or published later.
Access during the project ≠ access after project closure.
Decide who needs access during active work and what should be retained, restricted or deleted afterwards.
Decide who needs access during active work and what should be retained, restricted or deleted afterwards.
More data ≠ a better project.
Check which personal or sensitive information is actually necessary before collecting or storing it.
Check which personal or sensitive information is actually necessary before collecting or storing it.
Project coordination ≠ a data-protection decision.
SKF can coordinate project and funder routes, but it is not the data-protection authority.
SKF can coordinate project and funder routes, but it is not the data-protection authority.
STEP 2 · PRACTICAL WORKFLOW
Make data protection and ethics part of the project workflow
01
Clarify the information need
Identify which personal, confidential or sensitive information the project genuinely requires.
02
Describe the information flow
Record where information comes from, who receives it, where it is stored and how it may leave the project.
03
Assign responsibility
Define who is responsible for decisions, documentation, access and specialist questions where needed.
04
Plan consent and participant information
Where relevant, distinguish participation, documentation and publication of identifiable content.
05
Define storage and access
Plan suitable storage, access restrictions and safeguards before collection or production begins.
06
Plan retention and deletion
Decide which information is needed for how long and what should be deleted, restricted or retained after the project ends.
07
Plan specialist review in time
Involve the data-protection service and the applicable ethics or funder route where the project requires it.
08
Recheck before publication
Before sharing or publishing, confirm that the intended visibility matches the decisions already documented.
COMMON SCENARIOS
In these project situations, clarify the information flow especially early
Interviews, conversations & portraits
Keep participation, recording, internal analysis and possible publication of identifiable content clearly separate.
Participatory & collaborative work
Check which information about participants is created, who can see it and which later forms of presentation or publication are intended.
Confidential or sensitive material
Define access, storage, sharing, retention and deletion explicitly instead of leaving them to the general project workflow.
External project partners
Clarify which information moves between units, who is responsible and how handover or project closure will be handled.
Public outputs
Before a website, exhibition, publication or repository deposit, recheck which identifiable or sensitive information should actually become visible.
Funded projects
Include additional funder requirements, reporting obligations or applicable review routes in project planning.
STEP 3 · DOCUMENT DECISIONS
A simple data-protection & ethics log keeps decisions traceable
The log can be part of the project folder, material inventory or data management plan. What matters is that responsibility, access, retention and planned sharing remain understandable.
| Field | What to record | Why it matters |
|---|---|---|
| Material / information group | A clear name for the data, documentation, recording or material group. | Connects decisions to the correct project material. |
| Personal / sensitive content | Which personal, confidential or sensitive information is contained. | Makes protection needs visible early. |
| Purpose | Why the information is needed, collected, created or retained. | Prevents unclear or unnecessary collection. |
| Access | Which people, roles or project partners may access it. | Makes responsibility and restrictions traceable. |
| Storage | Where the information is stored and who manages the storage location. | Connects protection requirements to the actual working environment. |
| Consent / participant information | Which participation, documentation or publication decisions have been recorded. | Keeps different uses distinct. |
| Retention / deletion | How long the information is needed and what happens at project closure. | Prevents accidental indefinite retention. |
| Sharing / publication | Whether and how content is used internally, with restrictions or publicly. | Connects active project work to later publication. |
| Review | Date or event for rechecking, such as publication or project closure. | Ensures changed project plans are reviewed again. |
STOP & CHECK
Common warning signs in data protection and ethics
More personal information is collected than the project actually needs.
The information requirement was not clarified before work began.
The information requirement was not clarified before work began.
Participation and publication are treated as the same decision.
Permission to participate does not automatically cover every later use of identifiable content.
Permission to participate does not automatically cover every later use of identifiable content.
Access rights are undefined.
It is unclear who may see personal, confidential or sensitive information during the project.
It is unclear who may see personal, confidential or sensitive information during the project.
Retention and deletion are unresolved.
No one has decided what should be kept, restricted or deleted after project closure.
No one has decided what should be kept, restricted or deleted after project closure.
Public presentation is planned but has not been rechecked.
Before publication, exhibition or online release, confirm which information should actually become visible.
Before publication, exhibition or online release, confirm which information should actually become visible.
Several units are involved but responsibilities are unclear.
Project coordination, data-protection review and any applicable ethical review need distinct responsibilities.
Project coordination, data-protection review and any applicable ethical review need distinct responsibilities.
SERVICES & SUPPORT
Who is responsible for data-protection and ethics questions
Data Protection Officer / data-protection service
Primary specialist responsibility for questions concerning personal data and data-protection review.
Project / host unit
For project-level responsibility, working arrangements and the organisational anchoring of decisions.
Applicable ethics or funder route
For ethical review or additional requirements where the specific project or funding context requires them.
Support Kunst und Forschung (SKF)
Coordinates project and funder requirements and helps route specialist review; SKF is not the data-protection authority.
RELATED TOPICS
Data-protection and ethics decisions are often connected to these topics
TRAINING & WORKSHOPS
Training, workshops & consultation sessions
Relevant opportunities for this topic will be shown here automatically from the central calendar.
COMING SOONPRACTICAL RESOURCES
Info sheets, tutorials and templates
Info SheetsCOMING SOON
Short guidance on personal data, confidentiality, consent and ethical project questions.
TutorialsCOMING SOON
Step-by-step workflows for information inventories, access planning, retention and publication checks.
Checklists & TemplatesCOMING SOON
Templates for a decision log, project review and handover.
Need help finding the right route?
For questions concerning personal data, start with the data-protection service.
Where several units or funder requirements are involved, SKF can coordinate the project route and refer the question to the appropriate specialist review.
Search terms & related topics
data protection · ethics · personal data · sensitive data · confidentiality · consent · participation · publication · identifiable content · access · access control · storage · retention · deletion · sharing · data management · research data · project documentation · Data Protection Officer · ethics review · funder requirements · project partners · publication · repository