Data managent in Thesis: Thesis without a commissioning party

If you do not have a commissioning party, but you collect personal data in your thesis, a register of personal data is created. A register of personal data refers to structured information about research participants or other personal data collected for the study.

In theses, conducted without a commissioning party, Haaga-Helia and the student are joint data controllers, and in these cases, a so-called joint controllership agreement is established, for which Haaga-Helia has a template. Data controller is an entity that determines the purposes and means of processing personal data and is fundamentally responsible for the legality of the processing and the realization of the rights of the data subjects.

Data controller must maintain a description of the processing activities for which they are responsible, the contents of which are stipulated in Article 30 of the General Data Protection Regulation. The description must include the following information regarding all processing of personal data:

• the name and contact details of the data controller and joint data controller
• the name and contact details of the Data Protection Officer
• the purposes of the data processing
• a description of the groups of data subjects
• a description of the categories of personal data
• the groups of recipients to whom personal data have been disclosed or will be disclosed
• the planned retention periods for different categories of data, where possible
• a general description of the technical and organizational security measures, where possible.

An agreement template on a joint controllership of the thesis.

If you do not collect personal data, it is sufficient to prepare a comprehensive data management plan within your thesis plan.