General Data Protection Regulation


What is the GDPR?

The GDPR stands for General Data Protection Regulation. The GDPR became effective on May 25, 2018.

How do I know if the GDPR applies to my study?

If you will collect information from subjects who are physically located in the European Economic Area (EEA), the study is subject to the GDPR.

What countries are in the EEA?

Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the UK.

Does the subject have to be an EEA resident for the GDPR to apply?

The participant does not need to be an EEA resident.

Does the GDPR apply if the research involves the collection of data from EEA citizens who are physically located within the U.S. at the time of data collection?

The GDPR does not apply because the subject is not physically located in the EEA.

If the GDPR applies, do I need to inform subjects?

Yes. As part of the consent process, you must provide the GDPR Notice to subjects. The Notice is distinct from the consent form.

Where do I find the Notice?

GDPR Notice for Research Participants (.pdf)

GDPR Notice for Research Participants (.doc)



Do subjects need to sign the Notice?