GDPR for Researchers: A Practical Guide to Compliant Research

The GDPR applies to your research whenever you handle personal data of people who are in the EU or EEA, wherever you sit. It also applies when you transfer such data out of those countries. To comply, you need a lawful basis, extra safeguards for sensitive data, clear information for participants, and a plan for breaches. This guide walks through each step, including how to cite and source evidence without exposing the people behind it.

Hellenismwatch

Explore Research on the Greek Diaspora

Hellenismwatch monitors developments affecting the Greek diaspora across the Balkans and Eastern Mediterranean, drawing on credible sources.

Visit Hellenismwatch

TL;DR

The GDPR can cover a US-based study if participants are physically in the EU/EEA when their data is collected, or if the data is transferred out of the EU/EEA.
Consent is only one lawful basis. Public interest and legitimate interests can also work, with safeguards.
Ethnicity, religion and political opinions are special category data. They need an extra legal ground and stronger protection.
Pseudonymised data is still personal data. Only truly anonymised data falls outside the law.
Breaches usually must be reported to the supervisory authority within 72 hours of becoming aware of them.

What counts as personal data in research
When the GDPR applies to you
Choosing a lawful basis
Sensitive data: ethnicity, religion and politics
What participants must be told
If something goes wrong: breaches
Citing and sourcing without exposing people
Our perspective
Work with scholars who share these standards
FAQ
Sources

What counts as personal data in research

Personal data is any information that relates to an identified or identifiable living person. The person is the data subject. Under Article 4(1), someone is identifiable if they can be singled out directly or indirectly, for example by a name, an ID number, location data, an online identifier, or factors specific to their physical, genetic, mental, economic, cultural or social identity.

For researchers this is broader than it sounds. An interview transcript with a name removed may still point to one person if it mentions a rare job, a small town and a specific event. Survey responses linked to an IP address count. So do audio recordings and photographs.

Three boundaries matter in practice:

Pseudonymised data is still personal data. The European Commission says data that has been de-identified, encrypted or pseudonymised but can still be used to re-identify a person remains within the GDPR.
Anonymised data is outside it. Fully de-identified data is not personal data, according to Cambridge’s research guidance. The bar is high: nobody, including you, should be able to reverse it.
The dead and companies are not data subjects, but caution remains. The University of Groningen explains that data about companies and deceased persons is not personal data under the GDPR. Information about the deceased can still reveal facts about living relatives, so it should be kept confidential.

Researchers outside Europe often assume the law is not their concern. The test is not your nationality or your institution’s address. It is where the people are and where the data goes.

Brandeis University’s guidance says the GDPR applies to personal data collected in, or transferred from, an EU or EEA state, regardless of the subject’s nationality. It also says the same source: an EU citizen who is physically outside the EU/EEA when data is collected is not covered.

The European Commission describes the other triggers. The GDPR applies to an entity that processes data as part of the activities of an EU-established branch. It also applies to an entity outside the EU that offers goods or services to people in the EU, or monitors their behavior. Florida State University’s research office lists the same pattern for studies: EU/EEA-established studies, studies offering services to or monitoring people in the EU/EEA, and transfers of data out of the EU/EEA.

A quick screening checklist:

Are any participants physically in the EU/EEA when you collect their data (interviews, online surveys, focus groups)?
Is your team, lab or institution established in the EU/EEA?
Do you receive datasets from EU/EEA partners or archives?
Do you track online behavior of people in the EU/EEA, for example through web scraping tied to individuals or social media monitoring?

A yes to any of these means you should treat the project as GDPR-relevant and talk to your institution’s data protection office or ethics board before collecting anything.

Choosing a lawful basis

Many researchers believe consent is mandatory. It is not. A professional guidance note from the research industry bodies EFAMRO and ESOMAR lists the grounds researchers can use: consent, legitimate interests, and public interest or official authority. It adds that the GDPR sets no hierarchy among them, so consent is not automatically the best choice.

When you do rely on consent, it must be a clear affirmative statement or action, separate from other terms, and specific to the purpose. Silence, pre-ticked boxes and inactivity do not count, per the same guidance.

How to choose:

Situation	Basis often considered	Why
Publicly funded university study with a defined research mission	Public task (Article 6(1)(e))	UCL’s guidance uses this as the legal basis for personal data in its research
Independent research body or private institute	Legitimate interests (Article 6(1)(f))	Needs a documented balancing test and safeguards
Sensitive interviews, small samples, vulnerable participants	Consent, often alongside another basis	Gives participants control and supports ethics approval

The table is a starting point, not legal advice. Your data protection officer should confirm the basis and record it in your data management plan.

One point trips up many teams: consent for ethics purposes and consent as a legal basis are not the same thing. You can obtain informed consent to take part in a study while relying on a different legal basis for the data. Keep the two clear in your forms.

If consent is your legal basis and a participant withdraws, you must stop processing their data. The UK Health Research Authority states that in that case the data will need to be erased even if this seriously impairs the research. That is a strong reason to decide your lawful basis before fieldwork starts. For a deeper look at how organisations assess these risks, this GDPR risk assessment guide shows a structured approach you can adapt to a research project.

Sensitive data: ethnicity, religion and politics

Some research topics sit squarely in special category data. Cambridge lists these: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetics, biometrics for ID, health, and sex life or orientation. Processing them needs a special legal basis on top of the ordinary one.

If you study communities, identity, diaspora or political attitudes, you are almost certainly in this territory. Even a simple question such as “What is your religion?” creates special category data.

Processing is forbidden without explicit consent unless an exception applies. For research, Groningen explains the GDPR allows it when it is necessary for the research purpose, proportionate, respects the essence of data protection, and backed by suitable and specific safeguards, such as de-identification and encryption. UCL’s guidance applies Article 9(2)(j) for special category research data in the UK context.

Safeguards that work

UCL’s researcher guidance names the core safeguards: collect only the minimum personal data required, use pseudonymised data where compatible with the research, and anonymise where possible. In practice:

Replace names with codes and keep the key file in a separate, access-controlled location.
Encrypt laptops, drives and cloud storage that hold raw data.
Limit access to named team members and log who has it.
Set a retention date and delete or anonymise when it passes.
Avoid recording sensitive attributes you do not need to answer your research question.

What participants must be told

Transparency is a legal duty, not a courtesy. The ISCTE guidelines for researchers list what you must provide when collecting data directly from participants:

The identity of the data controller and the name of the researcher responsible
The purpose of the processing and its legal grounds
The rights participants can exercise, and contact details
The right to complain to the national data protection authority
The right to withdraw consent at any time, where consent is the basis
How long data will be kept
Whether data goes to third parties, and whether data leaves the EEA, including whether an adequacy decision exists

These points come from the ISCTE guidelines on personal data protection. Put them in a plain-language information sheet. If participants speak another language, translate the sheet, since information that cannot be understood does not inform.

Rights and research exemptions

Participants have rights of access, rectification, erasure, restriction and objection. Research gets some flexibility. Under Article 89(2), the rights of access, rectification, restriction and objection may be limited where they would prevent or seriously impair the research, subject to safeguards.

The UK version is written into law. Schedule 2, paragraph 27 of the Data Protection Act 2018 disapplies certain GDPR articles where they would seriously impair the research, but only if the data is processed in line with Article 89(1) and the results are not published in a form that identifies a data subject. The HRA adds that the right of access does not apply to health or social care research when safeguards are in place and results are not identifying.

The rules differ by member state, because Article 89 leaves room for national law. Check the law of the country where your participants live and where your institution is based. Do not assume one country’s exemptions apply everywhere.

If something goes wrong: breaches

A lost laptop, a misdirected email or an exposed spreadsheet can be a personal data breach. Ghent University defines it as a security breach leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. It notes that serious breaches must be reported to the national authority within 72 hours.

The UK Information Commissioner’s Office sets out the steps under UK GDPR:

Report certain breaches to the supervisory authority within 72 hours of becoming aware, where feasible.
Inform the individuals without undue delay if the breach is likely to cause a high risk to their rights and freedoms.
Record every breach, whether or not you must notify.
Include the essentials in the notification: the nature of the breach, categories and approximate numbers of people and records, the data protection officer’s contact details, likely consequences, and measures taken or proposed.

These steps come from the ICO’s breach guide. Tell your institution’s data protection office the same day you discover a problem. The 72-hour clock runs from awareness, and you rarely hold that decision alone.

Citing and sourcing without exposing people

Research is only credible when readers can check it. The GDPR does not forbid transparency. It asks you to be careful about who can be identified.

The University of Copenhagen’s guidance gives workable rules for publishing:

Anonymous data can be published when it cannot be linked to a specific person.
Aggregated data can be published only if individuals cannot be identified from the aggregates.
Verification by a journal editor should use pseudonymised data where possible. The editor must delete or return it after verification.
Editors outside the EU may require an agreement that includes the European Commission’s standard provisions, and the editor must give a declaration of compliance.

All of this is in the Copenhagen guidance on academic publications.

Turn that into citation habits:

Prefer public, documentary sources. Laws, court records, official statistics, published reports and archived media can be cited by link or catalog number.
Cite interviews by code and context, such as “Interview 14, community organizer, 2025,” rather than a name, unless the participant explicitly agreed to be named.
Check small cells. A table showing one person in a category is not anonymous. Merge categories or suppress counts.
Keep an audit trail. Hold the key to your pseudonyms and the original recordings in secure storage so an editor or reviewer can verify under the conditions above.
Link claims to the page that states them. Each factual claim should point to the specific source for that claim, not a general page on the topic.

Our perspective

Researchers working on diaspora communities, minorities and foreign influence handle exactly the data the GDPR treats most carefully: ethnicity, religion, political views. We do not see that as an obstacle. We see it as a discipline that makes work stronger.

At Hellenism Watch, our approach is built on documentation. We aim for every claim to rest on credible, checkable sources, and independence from government and party influence is central to how we work. The GDPR points in the same direction: collect what you need, say why, protect people, and show your evidence in a way that does not expose them.

The hardest cases arise when communities are small and everyone knows everyone. There, pseudonyms and aggregation have to be designed with care, and a global network of scholars helps. Colleagues in different countries know their national rules and community context, and that shared knowledge is why we invite contributions from scholars worldwide.

If your work touches Greek communities in the Balkans or the Eastern Mediterranean, bring your sources and your safeguards to the same table. Good evidence and good data protection belong together.

Alexios

If your research concerns the Greek diaspora, Hellenism, diaspora institutions or foreign influence networks, Hellenism Watch publishes free, source-backed articles and assessments. We also run an open fellowship for scholars around the world who want to contribute data and analysis.

Hellenismwatch

See the Hellenism Watch observatory for our publications, or read about our fellows and how researchers contribute.

FAQ

It can. It applies when your participants are physically in the EU/EEA at the time of collection, or when you receive personal data transferred from the EU/EEA. EU citizens who are outside the EU/EEA when data is collected are not covered. Confirm your situation with your institution’s research compliance office.

No. Consent is one lawful basis, alongside public interest and legitimate interests, and the GDPR gives none priority. The right choice depends on your institution and project. If you do use consent, it must be an explicit, specific, affirmative act, and participants can withdraw it.

No. Pseudonymised data can still identify a person if the key or other information is used, so it remains personal data. Only fully anonymised data falls outside the law. Pseudonymisation is still valuable as a safeguard, and regulators and universities recommend it.

How fast must I report a data breach?

Where a report is required, you must notify the supervisory authority within 72 hours of becoming aware, where feasible. If the risk to individuals is high, you must also tell them without undue delay. Record every breach, even those you do not report, and alert your data protection office immediately.

GDPR for Researchers: A Practical Guide to Compliant Research