6. Data management plan, Processing Registry and DPIA
Data management is all about being transparent about the way you are dealing with your sources. You do so by documenting this in advance. This document is called a data management plan (DMP). A DMP can change during your research, depending on changes in your research design as you go along.
When you’re processing personal data it is even mandatory to document a number of topics, e.g. the lawfulness of your processing, storage etc. (see Step 2. Working with personal data). This you do by registering your data processing in the Processing Registry.
If the data is very sensible, you might be asked by the privacy officer to do an Data Protection Impact Assessment (DPIA). This will result into a document more detailed then the DMP.
You can change your registration and DPIA, though there is currently no clear cut process for that.
So each of your research will have a DMP, when you process personal data, your (sub) research needs to be registered and, in some special cases, a DPIA is needed.
There are some exceptions to the necessity of a data management plan. When your data consists of sources which are (semi-)publicly available, like archival sources or literature, you can simply refer to this data in literature- and/or source-list in footnotes and/or end of your publication(s).
Creating and storing a data management plan
If you’ve used the template for listing data sets suggested in Step 1. Establishing your Sources and have gone through the previous steps, you have all the information you need to create a DMP.
There is quite a number of templates for data management plans. A number of funders, like NWO and ERC have their own template, which you can download from their portals.
You can also use DMPonline, a service from a UK based semi-governmental cloud service. Utrecht University has created two templates, one for a NWO DMP and another for an ERC DMP, both with extensive explanatory texts. Please be aware that, being a cloud service, your DMP will be stored on a server in the UK over which the UU has no control.
Please be aware you are responsible for keeping the data management plan up-to-date. So if you have used DMPOnline, than download your plan once you have a first version and store it on a save convenient place. You can also ask the data manager of the Faculty to store it for you. In time the faculty will create a facility for the central storage of DMP’s.
If you need support writing your DMP you can ask the data manager.
The Processing Registry and creating a DPIA
If you work with personal data in your research (sub)project, you should register your (sub) project in the Processing Registry. Currently there is a provisionally Processing Register for research data available at the faculty of Humanities. The faculty’s privacy officer can help you filling it out. In 2022 a new Registry is expected.
After you have registered your data processing, you’ll get an automated advice on the necessity of a Data Protection Impact Assessment. If you’ll have to create such an assessment you must contact the privacy officer, who will guide you through this assessment.