AAU logo

personal data


Processing of personal data for research purposes must be compliant with the General Data Protection Regulation (GDPR).

Please be aware that research projects, databases and biobanks where the researcher or group of researchers plan to process personal data shall be notified to Grants and Contracts.

The duty to notify a project, database or biobank to Grants and Contract  apply when ordinary (e.g. names, emails, gender, age etc.), confidential (e.g. cpr numbers, marks) and/or sensitive (e.g. health information, political views etc.) personal data are being processed for research purposes.

  • +


    If you process personal data in your student projects or assignments, you are data controller for this processing and it is your responsibility to comply with the General Data Protection Act (GDPR). You can read more about the GDPR on this webpage

  • +

    Sharing personal data with countries outside the EU

    When a research project includes the processing of personal data and when such personal data must be shared with countries outside the EU/EEA (so-called third countries), please contact Grants and Contracts before sharing the personal data with your third countries partners.

    For instance you should check whether the third country ensure 

    • an adequate level of data protection,
    • that the data subjects are informed of the sharing,
    • that the recipients based in a third country which do not ensure an adequate level of protection sign EU’s standard contractual clauses, and
    • that you conclude a data processing agreement or acquire that the Danish Data Protection Agency authorise the sharing.

    Link to Guide to sharing personal data with third countries 



  • +


    Are you or your partners processing personal data in a project? If so, please notify your project.


    Link to Notification form

    Link to Guide to the General Data Protection Regulation in relation to research

  • +

    Data Processing Agreement

    Will external researchers, partners or students process, store, collect etc. personal data on behalf of you? Will you store data on servers outside of AAU?

    Examples of data processors:

    • If a hospital is to analyze a test, take x-rays etc. on a test subject in your project, then the hospital is a data processor.
    • If a student is to collect data on your behalf, the student is a data processor.
    • Storing on servers outside of AAU

    General Data Processing Agreement for research

    Appendix 1 - Checklist

    Student Data Processor Agreement for research



If you have any questions regarding the General Data Protection Act in connection to research, please feel free to contact Grants and Contracts, AAU Innovation.  

Please send an email to persondata@adm.aau.dk.