Degree projects

Think carefully about and clearly describe why you are collecting personal data; this is the purpose of processing personal data. This helps determine which information is necessary to achieve that purpose.

It is often these that are used:

• Consent: when participants provide information themselves.
• Most frequently, the legal basis on which personal data processing is based is consent.
• Public interest: when the personal data is not collected from the data subject directly, for example, in internet studies or register-based studies.
• It is often not possible to inform and collect consent from each individual.

Only collect personal data if it is truly necessary.

Ask yourself:

• Can I do the study without personal data?
• Can I use less personal data?

You may never collect and process more personal data than is necessary for the purpose. Your supervisor will help you assess the processing of personal data in the intended work.

In independent academic papers at the undergraduate level (first cycle), it is not permitted to:

• Process sensitive personal data
• Process extra sensitive personal data

The examiner has the right to decide on exceptions.

If sensitive personal data is to be processed, see: Sensitive personal data and research projects

Personal data must be protected from unauthorised access and must not be disseminated to more people than necessary.

Keep in mind that:

• Only those who need it should have access.
• Computers should be password protected and have antivirus and firewalls.
• The computer's operating system and software that are used should be up to date with necessary security updates.
• You should use the university's central storage system (H: or home directory on your computer).
• When processing sensitive personal data, you must use H:/home directory.
• When storing locally on a computer or on mobile devices such as a mobile phone or USB, you must ensure that personal data is protected and that a back-up copy is made.
• External cloud services may not be used for processing personal data.
• Printouts should be stored safely and be destroyed in a secure manner.

• Personal data may not be stored longer than necessary.
• In most cases, it should be deleted when the work with the academic paper is completed and has received a passing grade.
• If the data is to be used in further studies, it needs to be saved, and the participants in the study need to consent to this.

Before the practical work begins, it is important to decide what will happen to the collected personal data. If the academic paper is part of a research project, see this heading further down: Sensitive personal data and research projects

According to GDPR, personal data may only be processed if there is a legal basis for the processing. You can read about how the legal basis is assessed in step 1 of the guide: “Step 1: Determine purpose and legal basis”.

If the personal data is collected directly from study participants, the legal basis is consent. Consent is needed from each individual participating in the study.

If you collect consent directly from individuals, you must, in writing:

• explain the purpose of the study
• tell us what data you want to collect
• explain how the personal data will be used and how long it will be stored

Participants must approve this before you begin.

Samtyckesmall och informationsbrev, studentarbeten (doc)

If major deviations from the template need to be made in a specific case, it is recommended that the supervisor contact the university's data protection group dataskydd@du.se or FER fer@du.se.

When your academic paper contains personal data:

• You must register the academic paper with the university's behandlingsregister.
• This is done so that the university can control the ongoing processing of personal data.
• Your supervisor is responsible for checking that the structure and planning comply with legislation and internal rules. This includes ethical considerations.

After you have submitted it for registration:

• You will receive an automatic response.
• You will not receive any further feedback.

If something changes in your work

You must re-register if:

• The purpose of your academic paper changes
• You start processing other categories of personal data.

You also need to register a change if:

• You change supervisor

Follow what you have planned and registered. You may only use the personal data in the manner you have informed us about.

When you have completed your academic paper and been examined in the module and your results have been registered in Ladok, you must:

• Delete personal data (including obtained consent)
• Or archive the personal data according to what you decided in “Step 4: decide what to delete”

The same personal data may be used for a maximum of five examination occasions within the space of no more than three years from the date on which the data collection began. If it has not been possible to offer five occasions within three years, the examiner may decide on a limited time extension.

If you are a student, you are responsible for ensuring that the personal data material is deleted when the work with your academic paper is completed or when three years have elapsed.

If you are writing your academic paper as part of a research project where Dalarna University is the research principal (huvudman), the following applies:

• Your personal data will be processed within the framework of the research project.
• The project's principal researcher (huvudansvariga forskare) is responsible for how personal data and research data are managed.
• You use the same legal basis as the research project, usually public interest.

Managing personal data and research data

• You must follow the rules that apply to the current research project.
• You will use the project's IT solution for all processing of research data.
• The IT solution must meet requirements for secure data processing.

In order to process sensitive personal data or information about violations of the law in research, approval from the Swedish Ethical Review Authority is required.

Independent academic papers at the bachelor’s (first-cycle) and master’s (second-cycle) levels do not count as research. They cannot therefore obtain their own ethics approval.

When your work is part of an ethics-approved research project

A degree project can be part of a research project that is led by a principal researcher and that has already received ethical approval. The following then applies:

• You follow the research plan and ethics approval that exist for the project.
• You process personal data with the same conditions as other researchers in the project.
• All processing of research data must take place in the project's IT solution with secure processing.

Keep in mind that:

• If you collect data directly from people, they must have been informed about how the data will be used, including in your degree project.
• The processing of personal data that you do within the project must already be included in the ethics application.

Processing of collected data

• Research data that you collect within the project becomes public.
• It is considered primary material in research.
• It should be archived, not deleted as is usually the case with a degree project.

Therefore, the recommendation is that if you, as a student, need to process sensitive personal data, do so within the framework of an ethics-approved research project where Dalarna University is the research principal (huvudman).

The circumstances under which you may process sensitive personal data in an independent academic paper that is not part of a research project are very limited. This is because students’ academic papers that are not part of a research project cannot receive ethics approval.

In order for it still to be permissible to process sensitive personal data in your independent academic paper, it is required that:

• There is a clear and documented need.
• There are procedures in place to protect the privacy of data subjects.

Based on the developed procedures, a general needs and risk analysis needs to be carried out by the institution as a basis for decisions on exceptions.

Specific for educational level:

• At the undergraduate (first-cycle) level, the processing is considered necessary for you to achieve the learning outcomes.
• The assessment must be documented and registered in the diariet.
• The same principle should also be used at the master’s (second-cycle) level.

In addition, it must be ensured that:

• The work is carried out in an ethically acceptable manner.
• Personal data is handled and protected securely.

It may also be appropriate to submit an application to FER.

Needs and risk analysis

Before you are allowed to process sensitive personal data within the framework of an independent academic paper (regardless of level), a needs and risk analysis must be conducted. It should contain:

Needs

• Why do you need to process sensitive personal data?
• Is it necessary to achieve the learning outcomes?
• Are there alternatives that you can use instead?

Education

• Get in-depth information about personal data processing: Personuppgiftsbehandling i självständiga studentarbeten - en handledning (pdf)
• GDPR training, for example, via the student website

IT security

• You may only use IT solutions that the university has approved.
• Sensitive personal data should be stored in your computer's home directory (H:)

Procedures for suitability assessment

• Consider whether the academic paper should be sent to FER and, through documentation, be able to demonstrate that the work involved with it complies with good practice and is ethically defensible.
• Personal data in academic papers – an eight-step guide to follow
• The suitability assessment should be made for each academic paper using FER's questions: Research Ethics Council (FER) - Dalarna University

Documentation

• The assessment must be documented and registered in the diariet.

The university advises students not to participate in research projects where Dalarna University is not the research principal (huvudman).

This is because:

• The university then lacks control over how the project is conducted.
• It is not possible to ensure that the work is carried out in a legally secure manner.
• It is unclear what responsibility the university can take for your participation in the project.

If external actors process personal data

This is unusual in degree projects, but can occur. If an external party (for example, a supplier of an IT service) processes personal data on behalf of the university, the following applies:

• A personal data processing agreement must be drawn up.

This applies to you as a student:

• In the first instance, use the IT services provided by the university.
• If you want to use other services, an agreement may be required.
• Contact data protection support if this may be relevant: dataskydd@du.se

You are a student in a teacher training programme and for your degree project, you plan to interview pupils at a school about their experience of the grades they received in the subject of Swedish. During one of the interviews, a pupil becomes sad and starts crying when the question about their grade comes up.

You are a student in a nursing programme. You are planning to conduct interviews with staff in a department about the work environment, stress and burnout. There is no plan to collect sensitive personal data.

Questions to reflect on: Even if you do not collect sensitive personal data, what risks to the research subjects do you consider there to be? What can happen during the interviews? What steps should you take BEFORE data collection to reduce or avoid harm to research subjects? Why should you do this?

* Note that the statement usually contains more specific comments and instructions.

FER normally has four meetings each semester. FER must receive applications no later than eight days in advance of a meeting, by 12 noon. 

2026