When your project handles personal data
When you use CSC's services to process personal data in your research project you need to select "We handle personal data in this project" when creating a CSC project. Read what is personal data from the office of the data protection ombudsman web pages. After this, you will be presented with a Description of processing activities form in MyCSC.
With this form, you describe the personal data processing activities that CSC performs on your behalf as a processor of personal data, the types of personal data and the personal data to be processed. You also need to mark if you handle special categories of data. Read more about sensitive data and about managing sensitive data on Research.csc.fi website.
This form is attached your CSC project and serves as an instruction to the processing of personal data for CSC. If you do not know how to fill in the form, please contact the data protection officer in your organization. Note also, that you can always edit and refine this description on your project's information page in MyCSC by clicking the pen icon, if the processing of personal data changes over time in your research project, or download the description as a PDF (see screenshot below).
Data processing agreement
In the GDPR definitions, processing essentially refers to anything you can possibly do with someone’s personal information: collecting it, storing it, destroying it, etc. GDPR compliance requires data controllers (in this case You as a CSC's service user) to sign a data processing agreement with any parties that act as data processors on their behalf (in this case CSC acts as a data processor on you behalf when You use our services).
The new data processing agreement and the description of processing activities form are mandatory parts of contracting to use CSC’s Services for Research and Education, if personal data is processed.
Please refer to:
- The Data Processing Agreement
- Service descriptions
- The CSC Data Policy
to find more detailed information on how we as data processor protect your personal data and you can assess the suitability of the service for the personal data processing activities you plan to do.