Handling personal data

Personal Data policy

• GDPR / AVG

  • The General Data Protection Regulation (GDPR) or Algemene Verordening Gegevensbescherming (AVG) is European legislation that regulates the privacy protection of natural persons from Europe in the processing and transfer of personal data in Europe. 
  • See the GDPR-LibGuide for more details and the Data Protection Impact Assessment tool.
  • Each faculty has one or more privacy champions. Privacy champions are the first persons to contact about concerns or questions about privacy and the GDPR.
    

• Reporting personal data breaches

  • The reporting of data breaches concerning personal data is covered in the GDPR. Read more about dataleaks and other security incidents on this page. 
  • (Suspicion of) data security breaches have to be reported to the IT service desk as soon as possible. VU policy on reporting data breaches can be found here. 
  • See the Policies & Regulations LibGuide for more details.
    

• Registration of personal data processing activities

  Under the GDPR, organizations like the VU and VUmc are obliged to keep a central record of processing activities carried out in the organization, including personal data used in scientific research. 

  • If your research involves processing personal data, this needs to be registered in VU's record of processing activities. 
  • Faculty privacy champions can help you register personal data in the VU's record of processing activities. 
  • Detailed information can be found on the GDPR-LibGuide.
    

• Medical Research Act / Wet Medisch wetenschappelijk Onderzoek

  The Medial Research Act is to offer test subjects proper legal protection. Research that falls under the scope of the WMO must first be tested by a recognised Medical Ethics Assessment Committee.
  You have to comply with WMO when

  • Medical research is carried out;
  • The subjects are subjected to actions and/or they are subjected to a certain behavior.