Do I need to sign the EU General Data Protection Regulation (GDPR) contract ?

Question

My university's ethics committee requires that the data collection platform is gdpr compliant, i.e. I'm not getting any more data (ip address etc) than I need. How do I prove it? Is there a document I could use to support my application?

Does this also mean I need to sign the EU General Data Protection Regulation (GDPR) CP contract? I don't know what it is.

I am not collecting personal information unless the participant wants to voluntarily give their name (for credits) in the photograph they have uploaded in the survey.

Thanks.

Answer 1

How do I prove it?

You can refer to these pages:
https://www.soscisurvey.de/en/privacy
https://www.soscisurvey.de/help/doku.php/en:general:privacy

There is no "the" GDPR compliant. The technical and organizational compliance depends a lot on the data that is actually processed. If you ask for a person's medical history, there are higher standards than for a which-is-you-favorite-film poll.

I am not collecting personal information

Well, then the GDPR does not apply, by law.

If you're collecting names, then collect them separately (there's a question for that in SoSci Survey) and use a filter to only offer this question if they uploaded an image. But please also note that images may be personal information.

Finally, it's the data prtectino officer of your institution who must tell you, if you need a CP contract. But please note, that this is only possible for the pro-server s2survey.net that cannot be used for free.

More information (not yet translated to English) is available here: https://www.soscisurvey.de/help/doku.php/de:general:dsgvo