Purpose of use, data content and data minimisation
The first section covered the legal basis for processing personal data. This section moves into practice: how to plan the use of personal data so that data protection is maintained throughout the entire research process.
The key principle is precision. The data permit application must specify exactly what data are being requested and for what purpose. Only the variables that are strictly necessary for the research should be extracted.
The less personal data is processed, the lower the data protection risk and the easier it is to manage processing securely.
Start with the following:
Define precisely why personal data are being processed.
Identify which registers contain the data you need and which variables should be extracted. Use the Data Resources Catalogue and define the selection criteria carefully.
Use only the data that is necessary. Consider whether the research can be carried out using anonymised data, or whether you need pseudonymised data.