Privacy scan - template

This upload contains a template for the privacy scan as used in the Faculty of Geosciences at Utrecht University.

The Privacy Scan (formerly known as Privacy Review) is a tool developed at the Geosciences Faculty designed to facilitate the process of evaluating and documenting a project’s GDPR compliance.

• All projects in the Geosciences faculty that process personal data need to undergo a Privacy Scan.
• The privacy scan of a project needs to be started at the same time the project is being designed, in order to implement the Data Protection by Design and by Default principles of the GDPR. 
  
• The privacy scan is 'living document': it is meant to be continuously edited and updated alongside the project life cycle, to always provide up-to-date documentation of the project’s compliance.
• For as long as personal data is processed (and storage is a type of processing), there should be a privacy scan that documents where data is being stored/processed, who is responsible for the project (and how can they be contacted), and when data will be completely deleted/anonymized – all details that demonstrate why this personal data processing is compliant with the GDPR.
• The responsibility to start and maintain a privacy scan rests with the individual(s) in charge of the project. 

For more information about the privacy scan in the Geosciences faculty, please refer to the Geo data support site. For more general information on how to handle personal data in research at Utrecht University, see the Data Privacy Handbook.