GDPR FAQs
-
What is the GDPR?
-
"GDPR" stands for General Data Protection Regulation. The GDPR became effective on May 25, 2018.
-
How do I know if the GDPR applies to my study?
-
If Princeton research personnel (including an independent contractor, enumerators, or a contract research organization) are physically in the EEA (see below list of countries) to perform the study procedures, GDPR applies to the study.
If Princeton research personnel (including an independent contractor, enumerators, or a contract research organization) are not physically in the EEA to perform the study procedures, (e.g., the study consists of online surveys, questionnaires, or interviews via Skype) the GDPR applies IF the following criteria are met:
- the study targets participants in the EEA.
- the study tracks or monitors subjects’ behavior/attitudes/responses over time.
- and the study results will be used to generalize about the subjects or predict their behavior.
-
What countries are in the EEA?
-
The EEA consist of the following countries: Austria, Belgium, Bulgaria, Croatia, Republic of Cyprus, Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, and the UK.
-
Does the subject have to be an EEA resident for the GDPR to apply?
-
The subject does not need to be an EEA resident for the GDPR to apply.
-
Does the GDPR apply if the research involves the collection of data from EEA citizens who are physically located within the U.S. at the time of data collection?
-
If the subject is not physically located in the EEA, the GDPR does not apply.
-
If the GDPR applies, do I need to inform subjects?
-
Yes. As part of the consent process, you must provide the GDPR Notice to subjects. The Notice is distinct from the consent form.
-
Where do I find the Notice?
-
Do subjects need to sign the Notice?
-
No.
-
GDPR training