The processingThe term 'processing' is defined as 'any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;' (BlnDSG §31, 2020; EU GDPR Article 4 No. 2, 2016). Processing therefore refers to any form of working with personal data, from collection to erasure. Read More of personal dataPersonal data includes: 'any information relating to an identified or identifiable natural person (data subject); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person(…)” (EU GDPR Article 4 No. 1, 2016; BDSG §46 para. 1, 2018; BlnDSG §31, 2020). Read More is only permissible for specified and clear purposes. These purposes should ideally be determined as precisely as possible before data collection and, where feasible, documented in a consentInformed consent refers to the agreement of research participants to take part in a study based on the basis of comprehensive and understandable information. The design of an informed consent must address both ethical principles and data protection requirements. Read More form as part of the research project. Further processing steps are tied to this initial purpose. If the purposes change or expand during the research project – for instance, if new research questions arise during data analysis – additional consent from the affected individuals may need to be obtained. Data must be deleted once the purpose has been fulfilled.

Personal data may not be stored in an identifiable form for longer than necessary for the intended purposes.

The scope of personal data processing must be proportionate to the purpose, meaning only the minimum amount of personal data necessary and feasible should be collected and processed (BlnDSG §32, 2018).