Provisions On Data Confidentiality and Personal Data Protection In Research and Community Development Activities (RCD) At Atma Jaya Catholic University of Indonesia

---

 

I.                    This provision outlines the regulations regarding data confidentiality and the protection of personal data in the conduct of research and community development (RCD) activities.

 

II.                  Researchers and practitioners involved in RCD activities are required to ensure the protection of both data confidentiality and personal data throughout the execution of these activities.

 

III.                RCD practitioners must submit their research for ethical review to the ethics committee through the process of ethical clearance for every research topic involving human or animal subjects. The regulations concerning the ethical clearance process are governed separately from these provisions.

 

IV.                 Data Confidentiality for Non-Human RCD Subjects

1.     RCD practitioners are obligated to ensure data confidentiality by adhering to relevant laws and specific guidelines issued by funding entities.

2.     If the object of RCD activities includes Atma Jaya Catholic University of Indonesia, any of its subsidiary units, or its employees, the execution of RCD, including data processing (e.g., collection, storage, analysis, sharing, transfer, and publication), can only be carried out with prior approval from the Rector of the University. The request for approval must be submitted through the Institute for Research and Community Development (LPPM) of the university.

 

V.                   Personal Data Protection in Human-Related RCD Activities

 Personal data protection in RCD activities involving human subjects is governed by and must comply with Law No. 27 of 2022 on Personal Data Protection (UU PDP), with the   following stipulations:

 

1. Scope of Personal Data The personal data processed during RCD activities may include: a. Personal Data of Research Participants b. Personal Data in Research Collaboration

 

a.     Processing of Research Participant Data

The personal data of research participants is processed on a case-by-case basis. Atma Jaya Catholic University of Indonesia shall, to the greatest extent possible, anonymize or pseudonymize participant data, unless the participants are involved in public forums such as seminars or focus group discussions (FGDs), where the dissemination of their opinions or ideas is inherently intended for public disclosure. When data is directly collected from participants, they must be informed at the outset about the nature of the data being collected, its purpose, the legal basis for processing, the duration for which the data will be retained, and whether it will be shared with third parties. In line with UU PDP, data previously collected may also be processed for research purposes. In such cases, the data subjects will be individually informed about the specifics of the data processing. If individual notification is impractical, relevant information will be publicly disclosed. This applies to both previously collected data and data obtained from third parties.

 

b.     Personal Data in Research Collaborations

1)     Scope In RCD activities, certain projects may require data sharing among collaborators to fulfill contractual obligations with funders. In larger projects, this often involves coordination from a project coordinator. In instances where personal data is transferred, the provisions on data transfer within UU PDP apply. The personal data of project staff must be stored in the partner's data repository as per grant agreements, consortium agreements, or other forms of collaboration, subject to the data retention provisions under UU PDP. When Atma Jaya Catholic University of Indonesia acts as a project coordinator responsible for financial reporting to the funders, all project partners are expected to provide necessary supporting documents, which may contain personal data (e.g., payments, professional fees, logbooks, contracts).

 

2)     Types of Personal Data Personal data in this context may include, but is not limited to: a. Identity information, such as name, date of birth, address, telephone number, and nationality. b. Financial data, such as account numbers, salary slips, and work-related expense receipts.

 

3)     Data Sharing Only staff members of Atma Jaya Catholic University of Indonesia who require access to project expenditure documentation (e.g., honoraria, professional fees) to fulfill their roles as project coordinators shall have access to this data.

 

4)     Project managers will process the data in a secure, well-controlled archival system with reliable access controls. Data sharing is only permitted in response to information requests from funders or external audit requests.

 

5)     Data Retention Personal data shall not be retained longer than necessary for the purposes of processing. After the audit period or the expiration of the accountability period, Atma Jaya Catholic University of Indonesia will delete the documents supporting work-related costs unless the retention of personal data is still required to meet legal obligations.

 

2.      Data Subject Rights Data subjects in the context of RCD data processing include donors, RCD participants, and third parties. Their rights are as follows:

a.     Donor Rights Donors may request access to or correction of their personal data stored or controlled by Atma Jaya Catholic University of Indonesia. Donors can submit such requests through LPPM of the university.

b.     b. RCD Participant Rights RCD participants are informed of their specific rights through a document provided at the start of the activity. This document includes contact details for the person in charge, should participants wish to exercise their rights. In principle, research participants are entitled to access and, if necessary, correct their data processed in the context of RCD. The document also outlines the purpose and legal basis for the data processing. If data is processed based on consent, participants have the right to withdraw consent at any time. Withdrawal of consent does not affect the validity of prior data processing. However, in some research contexts, the exercise of certain data subject rights may be limited due to the potential adverse impact on the research goals.

 

Third-Party Rights Any third party whose personal data is processed in the context of RCD collaboration has the right to review and, if necessary, correct their