GDPR in research
SIMAR co-ordinates common procedures, issues recommendations and provides training for the research community on GDPR. It consults the legal interpretation with the Czech Data Protection Authority and with an expert team that includes lawyers. The whole research industry — the agencies associated in SIMAR — acts in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data).
SIMAR’s updated recommendation of 3 November 2020 on co-operation between the client and the agency in protecting personal data contains a simple definition of who is the controller and who the processor, and the conditions under which a client may carry out a GDPR audit at a research agency.
Detailed guidance on running research projects in line with the GDPR, on the controller–processor relationship and SIMAR’s recommendations can be found here (the recommendation of September 2018).
The Ten Principles FOR RESEARCH — the rules for protecting personal data in market research, public opinion research and data analytics — are here.
The industry’s ethical rules — the ICC/ESOMAR Code — can be found here.
SIMAR articles on the member agencies’ joint approach to protecting respondents’ personal data (in Czech only):
