4.2 Personal data processing in thesis work

With comments for supervisors

Introduction

The university is, as the controller, responsible for all processing of personal data in the university's activities. This also applies to the processing that accompanies our students' degree projects, in cases where they choose to work with personal data. It is therefore important that you, as a supervisor, can help guide our students correctly in the applicable regulatory framework and can provide accurate information to the students who process personal data. In short, the treatment should be registered in the university's personal data processing records, the data subjects must be informed, the data collected correctly, processed and stored properly and finally deleted or archived, depending on the circumstances.

This text is intended to support those of you who deal with student essay work and aims to provide the basic knowledge needed for the processing to be correct. Of course, it is not possible to give a complete and exhaustive explanation of the General Data Protection Regulation within these pages, but the text should provide sufficient knowledge to handle a normal degree project which processes personal data. In case of questions and uncertainties, the Data Protection Officer should be consulted. 

A short 8-step tutorial for students intending to use personal information is available in sections 4.2.1 - 4.2.8. The sections also include explanations and comments for you who act as supervisors. In unclear cases, the Data Protection Officer should be consulted (dataskyddsombud@lnu.se

The General Data Protection Regulation, together with a number of Swedish laws attached to it, imposes strict demands on all work on personal data being performed correctly. Therefore, if you are thinking of using personal data for your degree project, there is a lot to think about. This text provides a brief overview of the steps necessary for the processing of personal data to be correct. In addition to the rules governing personal data, depending on what you intend to process, there may be additional legislation to take into consideration, and you should have an overall discussion with your supervisor about what information is to be processed and plan accordingly.)