GDPR in student essays and projects

You may need to process personal data when you write a student essay or project. We recommend that you try to avoid processing personal data whenever possible. If you must do so, this webpage and the documentation will help you comply with the applicable legislation.

The university has produced a GDPR guide on processing personal data when writing student essays/projects. Links to documents about GDPR and student essays are provided below.

Step-by-step guide for students

Evaluate whether it is necessary to process personal data to achieve the essay/project’s objective. If it is necessary, define the purpose of processing the personal data and evaluate what data must be collected.

  1. Check that sensitive personal data will not be processed. However, if it will be, the subject that the essay is intended to cover must undergo ethical review. This is done by the supervisor in your department.
    Security measures for processing personal data in student projectsWord
  2. Decide how the information will be stored and, in consultation with your supervisor, ensure that it is processed securely during your work.
    Form for registering student projects Word
    Example of a digital registerExcel
  3. In consultation with your supervisor, decide which parts of the information will be erased or retained when work is completed.
  4. Fill in the information letter and consent form.
    Information and consent formWord
    Information and consent form, sensitive personal dataWord
    Consent formWord
    Template for information text, studenterWord
  5. Inform and collect consent from every single person who will participate in the study, collect the necessary personal data, and process the personal data in accordance with what was decided in steps 1-5 above.
  6. After the essay project has received a pass grade, erase or archive the personal data material in accordance with what you decided in step 4.
    Erasure routine (in Swedish, for use by staff)Word