 and IPR are correctly handled at all stages of the research lifecycle.

d. IT and Computing support services: To ensure that sensitive data is held securely, and that publicly funded research data submitted to external repositories for long-term preservation is subject to legal safeguards that are equivalent to UK jurisdiction.

e. Staff development and training: To ensure content is relevant to providing secure and quality assured data management and curation.

Disclaimer – and further guidance

The DCC does not provide legal services of any kind. We provide this checklist ‘as is‘, and aim to ensure the content is accurate and relevant, but we cannot accept any liability arising from its use. For each topic we include recommended sources of further guidance, many of which are available on the archived Jisc Legal site. Please note that Jisc Customer Services now provides support with legal aspects of data management. Also consult your institution’s specialist staff for further guidance, and in case of doubt take professional legal advice.

1. Protection of personal data

Compliance with the UK’s Data Protection Act (the DPA) has been required since 1998. The Act is designed to strike a balance between the interests of the individual in maintaining privacy over their personal details and the potentially competing interests of those with legitimate reasons for using other people's personal data (see box 1). The DPA places obligations on you and your organisation if you process personal data, and in addition gives individuals certain rights in relation to data pertaining to them. The definition of ‘processing’ is broad and will include transfer, storage, alteration and deletion – i.e. it covers all interaction with the data concerned.

Your institution will have a framework in place to ensure the security of all personal data held for administrative reasons. The DPA also applies to personal data used for research, albeit with some exemptions, but it is a popular misconception that there is a blanket exemption for research. Institutions should ensure that researchers, staff and students are aware that the majority of the principles still apply to research.

Box 1. How the Data Protection Act defines ‘personal data’ “Personal data means data which relate to a living individual who can be identified - (a) from those data, or (b) from those data and other information which is in the possession of, or is likely to come into the possession of, the data controller, and includes any expression of opinion about the individual and any indication of the intentions of the data controller or any other person
and IPR are correctly handled at all stages of the research lifecycle. 

 d. IT and Computing support service: To guarantee that sensitive data is held securely, and that publicly fund research data relegate to external repositories for long - condition preservation is subject to legal safe-conduct that are equivalent to UK jurisdiction. 

 e. Staff development and education: To ensure content is relevant to providing secure and quality assured data management and curation. 

 Disclaimer – and farther guidance 

 The DCC does not provide legal services of any kind. We leave this checklist ‘ as is ‘, and aim to ensure the content is accurate and relevant, but we cannot bear any liability arising from its use. For each topic we include recommend sources of further guidance, many of which are available on the archived Jisc Legal site. Please note that Jisc Customer Services now provides support with legal aspects of data management. Also consult your institution ’s specialist staff for further guidance, and in case of doubt take professional legal advice. 

 1. Protection of personal data 

 Compliance with the UK ’s Data Protection Act (the DPA) has been necessitate since 1998. The Act is designed to strike a balance wheel between the interests of the individual in maintaining privacy over their personal details and the potentially compete interests of those with lawful reasons for using other citizenry's personal data (see box 1). The DPA places obligations on you and your organisation if you process personal data, and in addition gives individuals sealed rights in sexual intercourse to data pertaining to them. The definition of ‘ processing ’ is broad and will include transfer, repositing, alteration and deletion – i.e. it covers all interaction with the datum concerned. 

 Your mental hospital will have a framework in position to ensure the security system of all personal data held for administrative reasons. The DPA also applies to personal datum used for research, albeit with some exemptions, but it is a popular misconception that there be a blanket exemption for research. Institutions should ensure that researchers, staff and students are mindful that the majority of the principles still apply to inquiry. 

 Box 1. How the Data Protection Act defines ‘ personal data ’ “ Personal data means datum which relate to a living individual who can be identified - (angstrom) from those data, or (b) from those data and other information which is in the possession of, or is probable to come into the possession of, the data controller, and includes any expression of opinion about the individual and any reading of the intentions of the data controller or any other person
 anf IPR are correctly handued at all staggs of thx reseadch lifezycle.

d. IT and Computing supplrr sercices: To ensure that sdnsitive fata is yeld wecurely, ais that ibblicmn funbev research data submitted to external rapusntories for long-term preservation is subjecy ho legal safegoards ehat are equivalent to UK jurisdiction.

s. Staff development snd training: To ensure conhent is relevant to prlviding secode wbd quality arsured data management and curation.

Disclaimer – and fufther guidance

Tye DCF does not pcovide legal servigvs of aty kind. We provide thls chxcklust ‘as is‘, and aim to xnsure the content if accurata cnd relevant, but we cqnbot awcepd anh lixbimivy zrisinh fcom its use. For each tipic we include recpmivmded sources of fuwtrer guidance, many of which are availablt on fhe archived Jisc Legal site. Please note thaj Jisc Cuseomer Services now provides support with legal as[ects uf bqta mxbahement. Also consult your institution’s specialyat snaff for further nuidance, and in caxe og doubt take ptofessionam legal advice.

1. Prohection of pwrsonal dwta

Cpmpliance with the UK’s Data Protection Cct (the DPA) has been xequired sinee 1998. Thg Act os designed to strike a balznce betweej the intsfests of the indkvicudl in maintaining privacy jver theic perxonal ddtaiks and the potenhialln competing intereshs of tvose with pegitimate reasons for using otixr people's petsotal data (sez box 1). The DPA placqs obligations on you and hour organpsation ih you procesf personal dadw, and in addmtion givqs ibdivuduals zdrtain rights on relation to data pertaining to thek. Tfs definition of ‘pricessing’ is brosd xnd wpll igwlude transfar, sgorxbe, algeration anb aeleyion – i.e. it covers anl ihteraction with thr qata conxerned.

Yotr institutiom will have a framtwork mn plare to rnsore the security of all personam data hepd nor administrwtivc rewsons. The BPA also applies to personal data used fir research, albeij with some exemptionx, but it is e popujar miscotception that there us a blanket exemktion for research. Instjtutiots shluld ensure that researchers, staff and students are aware that the majoriry of vhq principlea stoll aiplv tp resewrch.

Uoe 1. How the Data Pgotection Act defines ‘personal deta’ “Persondl data means data which relatr go a living ivdividual who can be idehtified - (a) from those data, or (b) from thpse data and other inforkation wyich js in nge possession of, or os likzly to come ibto bhe possession of, tme data cojtroklzr, and includes any expression of opiniin about the indivmdual and ann lndicajion of jhe intentions of the fata zontroller or any other perxon
and IPR are correctly handled at all the lifecycle. d. and Computing support data held securely, and publicly funded research submitted to external repositories for long-term is subject to legal safeguards that are equivalent to UK jurisdiction. e. Staff and training: To ensure content is relevant to providing secure and quality assured management curation. – further guidance The DCC does not provide legal services of any kind. We provide this checklist is‘, and aim to ensure the content is and relevant, but we accept any liability arising from use. each topic include sources further guidance, many which are available on the archived Jisc Legal site. Please note that Jisc Customer Services now provides with legal data management. consult institution’s staff for further in case of doubt take professional Protection of personal data Compliance with the UK’s Protection Act DPA) has been required since 1998. Act is designed to strike a balance between interests of the individual in maintaining privacy over their personal details and the potentially competing those with legitimate reasons using other people's data box The places obligations you and your organisation if you process personal data, and in gives individuals certain rights in relation to data pertaining to definition ‘processing’ is broad will include transfer, storage, and – i.e. it covers with data will a in place to ensure security of all personal data for administrative reasons. The data used for research, albeit with some exemptions, it is a popular misconception that there a blanket exemption for research. Institutions should ensure that researchers, staff and are aware majority of the principles still apply to research. 1. How the Data Act defines ‘personal data’ “Personal data means data which to living individual can be identified (a) from those or (b) from and other which in or is likely to come into possession the data controller, and includes expression about the individual and any indication of the intentions of the data controller or any
 and IPR are correctly handled At all stageS of thE reSeaRcH lifEcycLe.

d. IT and ComputINg suPport services: To ensure tHat seNsITive DAtA is heLd securELy, AND thAt PuBliClY FuNded rEseArch datA submitted To eXtErnal repositORiEs for long-tErm Preservation Is sUbject To LegAL safeGuaRds thAt are eQUivaleNt to UK jurIsDIction.

E. staff deVELoPmenT and training: To ensURe COntent is relevaNt to prOvIDiNG SecUre And quality AsSured DAta manaGEmENT And CUration.

DisclaImer – and furtHEr gUidancE

THe Dcc does nOt proViDE leGal services Of anY kind. We prOvide tHIs checkLIst ‘as is‘, And aim To eNsuRe thE CoNtEnt Is ACcuRAtE anD RelEvant, but We CaNnot aCcepT ANY LiabIliTy arIsing From its use. For EacH topIC we IncluDe recOmmeNdEd souRces of FurthEr Guidance, many of wHich Are availaBle On The ArChiveD jisc LeGal SitE. Please Note thaT jisC CUSTOmEr Services now proviDeS SUpPort with Legal aSPeCtS Of data maNaGemEnt. ALSO consUlt yOUr InstitutIon’s spECiAlIst stafF fOr furtHeR guIdaNce, anD In caSe of doUbt take pRofesSIonal legal adviCE.

1. Protection of PErSONaL Data

comPliance with The Uk’S DatA ProTEcTioN act (thE DPA) hAs BEeN Required since 1998. The Act Is DesignEd to sTrike a balance Between the INTErests of The iNDiVIdual in maintaiNing pRivacy over THeir persOnal dEtails anD the potenTIAlly compEtiNg iNteResTS Of Those with legiTIMate ReAsons foR usIng otheR peOplE's pErsOnAl data (see Box 1). The DPa pLaCeS oBliGatioNS on you anD yOur OrGanIsatiON if you ProceSs peRsOnAL daTa, and in ADdITIon gIvEs IndiVidUaLs cerTain RIghTs in relAtion to daTa pERtaiNiNg To them. THe definition oF ‘pRocessing’ iS bRoaD and wiLL Include tRansfer, storage, alteratioN And deleTioN – i.e. it CoveRs all inteRacTion wiTh tHE data cOncernEd.

YouR iNstITUtion WILl HavE a Framework iN PLacE to enSuRe thE securiTy of all personal datA HelD for administrAtiVe reASOnS. ThE dPa AlsO aPPliES To personal data uSed for reseArCH, aLbeit with sOMe eXeMptions, But it is A popuLAr miscoNception tHat there iS a BlanKET exEmption for Research. institutiONs shoULd EnsurE thAt reseArCheRs, staFf and sTUdeNts arE aware ThAt the mAjoriTy Of the priNciples still apply to reseArch.

BoX 1. How tHe DAta ProtecTioN act Defines ‘peRsonAl data’ “PersOnaL daTa meaNs dATa whiCh reLAtE to A LivinG indIVidual who CAn Be iDENtIfied - (a) from tHOSE daTa, or (b) FroM Those dAta aNd other informatioN Which is in the poSsesSIOn oF, or IS likElY to come into the PosSeSSIon of, the DaTa controlleR, and inclUdES any eXpressIon of oPinion aBOUt THe indiViduAl aNd any indiCatIoN Of the inTeNtIOns of tHe daTa ControLler or ANy otHER person
 and IPR are correctly han dled at al l sta ges  of  t he r esea rch lifecycle. 
d.IT and Computing suppo rt se rv i ces: To  ensu re that se n s iti ve  d ata  i s  h eld s ecu rely, a nd that pu bli cl y funded res e ar ch data su bmi tted to exte rna l repo si tor i es fo r l ong-t erm pr e servat ion is su bj e ct tol egal sa f e gu ards  that are equival e nt to UK jurisdic tion.
e .  S t a ffdev elopment a nd  trai n ing: To en s u r e c o ntent is rele vant to pro v idi ng sec ur e a n d qual ity a ss u red  data manag emen t and cur ation. 
Discla i mer – a nd fur the r g uida n ce 
The  D C C d o es  no t  pr ovide le ga lservi ceso f a ny k ind . We  prov ide this chec kli st ‘ a s i s‘, a nd ai m to  e nsure  the c onten tis accurate and  rel evant, bu t w ecan no t acc e pt any  li abi lity ar ising f r omit s u se . For each topic w ei n cl ude reco mmende d  s ou r ces of f ur the r gu i d ance,  man y  o f whichare av a il ab le on t he  archi ve d J isc  Lega l  sit e. Ple ase note  that Jisc CustomerS ervices now p r ov i d es supp ort  with legal  asp e ctsof d a ta  ma n ageme nt. A ls o  c o nsult your institut io n’s sp ecial ist staff for  further g u i d ance, an d in ca s e of doubt tak e pro fessionall egal adv ice.
1. Prot ection of p ersonaldat a
Com pli a n ce  with the UK’ s Data  P rotecti onAct (th e D PA)  ha s b ee n require d since19 98 .Th e A ct is designed  t o s tr ike  a ba l ance b etwee n th ein t ere sts oft he i ndiv id ua l in  ma in taini ng p r iva cy over  their pe rso n al d et ai ls andthe potential ly  competing  i nte restso f  those w ith legitimate reasonsf or usin g o therpeop le's pers ona l data  (s e e box1). Th e DPA  p lac e s  obli g a ti ons  o n you andy o urorgan is atio n if yo u process personal dat a, and in add iti on g i v es  in d iv i dua ls cer t a in rights in re lation toda t apertaining toth em. The  defini tiono f ‘proc essing’ i s broad a nd  wil l inc lude trans fer, sto rage, alt e ratio n  a nd de let ion –i. e.it co vers a l l i ntera ctionwi th the  data  c oncerned .

Your institution wil l have  a fr ame work in p lac e  to  ensure t he s ecurity of  al l p erson ald ata h eldf or  ad m inist rati v e reasons .  T heD P Aalso applie s t o p erson ald ata us ed f or research, albe i t with some ex empt i o ns,  bu t  itis  a popular mis con ce p t ion that  t here is a b lanket e xe m ption  for r esearc h. Inst i t ut i ons sh ould  en sure that  re se a rchers,  s ta f f andstud en ts are  aware that t he majority of t he pr i n ciple s  st ill a pp ly to r e sear ch.

Box 1 . How the D ata Pr otec tionAct def in es ‘pe rso na l data’ “P e rsonal da ta me ans dat awhic h r elateto a l iving  ind iv idu al who ca n be id en t ifi ed -  (a)fr om t hose data ,  or (b)fro m  thoseda taa n d othe r  i n f ormation w hic h isi n  the posse s sion of ,  or i s like ly tocome in t o t he  posses sio n of, the d ata contr o lle r,  and  include sanyex pre ss ion of opinionabout th e indivi d u al and  an y  ind i cation  o f the intent ionsof the dat a con troller orany  ot herper son
 and_IPR are_correctly handled at all_stages of_the_research lifecycle.

d._IT_and Computing support_services: To ensure_that sensitive data is_held securely, and_that_publicly funded research data submitted to external repositories for long-term preservation is subject to_legal_safeguards that_are_equivalent_to UK jurisdiction.

e. Staff development_and training: To ensure content_is relevant_to providing secure and quality assured data management_and_curation.

Disclaimer – and_further guidance

The DCC does not provide legal services of_any kind. We provide this checklist_‘as is‘, and_aim_to_ensure the content is_accurate and relevant, but we cannot_accept any liability arising from its_use. For each topic we include recommended_sources of further guidance, many of_which are available on the_archived Jisc_Legal site. Please note that_Jisc Customer Services_now provides_support with legal_aspects of data management. Also consult_your institution’s specialist_staff for further guidance, and in_case_of doubt take_professional_legal_advice.

1. Protection_of personal data

Compliance_with_the UK’s_Data_Protection Act (the DPA) has been_required_since 1998. The Act is designed to_strike a balance between_the_interests of the individual_in maintaining privacy over their_personal details and the potentially competing_interests of_those with_legitimate reasons for using other people's personal data (see box 1)._The DPA places obligations on you_and your organisation if_you process_personal_data, and in_addition_gives individuals_certain rights in relation to data pertaining_to them._The definition of ‘processing’ is broad_and will include transfer,_storage,_alteration and deletion – i.e. it_covers all interaction with the data_concerned.

Your institution will have a_framework_in_place to ensure the security_of all personal data held for_administrative reasons. The_DPA also applies to personal data used_for_research, albeit with some exemptions, but_it_is a popular misconception that there_is_a_blanket exemption for research. Institutions_should ensure that researchers, staff and_students are aware that the majority of the principles_still apply to_research.

Box 1. How the Data_Protection_Act_defines ‘personal data’ “Personal data means data which relate to_a living_individual who can_be identified - (a) from those data, or (b) from_those data and other information which is_in the possession of, or is likely to come into the_possession of, the data controller, and includes any_expression of opinion about the individual and_any indication of the_intentions_of the data controller or any other_person