I. This provision outlines the regulations regarding data confidentiality
and the protection of personal data in the conduct of research and community
development (RCD) activities.
II. Researchers and practitioners involved in RCD activities are required to
ensure the protection of both data confidentiality and personal data throughout
the execution of these activities.
III. RCD practitioners must submit their research for ethical review to the
ethics committee through the process of ethical clearance for every research
topic involving human or animal subjects. The regulations concerning the
ethical clearance process are governed separately from these provisions.
IV.
Data Confidentiality for Non-Human RCD Subjects
1. RCD practitioners are obligated to ensure data confidentiality by
adhering to relevant laws and specific guidelines issued by funding entities.
2. If the object of RCD activities includes Atma Jaya Catholic University
of Indonesia, any of its subsidiary units, or its employees, the execution of
RCD, including data processing (e.g., collection, storage, analysis, sharing,
transfer, and publication), can only be carried out with prior approval from
the Rector of the University. The request for approval must be submitted
through the Institute for Research and Community Development (LPPM) of the
university.
V.
Personal Data Protection in Human-Related RCD Activities
Personal data protection in
RCD activities involving human subjects is governed by and must comply with Law
No. 27 of 2022 on Personal Data Protection (UU PDP), with the following stipulations:
a. Processing of Research
Participant Data
The personal data of research participants is
processed on a case-by-case basis. Atma Jaya Catholic University of Indonesia
shall, to the greatest extent possible, anonymize or pseudonymize participant
data, unless the participants are involved in public forums such as seminars or
focus group discussions (FGDs), where the dissemination of their opinions or
ideas is inherently intended for public disclosure. When data is directly
collected from participants, they must be informed at the outset about the nature
of the data being collected, its purpose, the legal basis for processing, the
duration for which the data will be retained, and whether it will be shared
with third parties. In line with UU PDP, data previously collected may also be
processed for research purposes. In such cases, the data subjects will be
individually informed about the specifics of the data processing. If individual
notification is impractical, relevant information will be publicly disclosed.
This applies to both previously collected data and data obtained from third
parties.
b. Personal Data in Research
Collaborations
1) Scope In
RCD activities, certain projects may require data sharing among collaborators
to fulfill contractual obligations with funders. In larger projects, this often
involves coordination from a project coordinator. In instances where personal
data is transferred, the provisions on data transfer within UU PDP apply. The
personal data of project staff must be stored in the partner's data repository
as per grant agreements, consortium agreements, or other forms of
collaboration, subject to the data retention provisions under UU PDP. When Atma
Jaya Catholic University of Indonesia acts as a project coordinator responsible
for financial reporting to the funders, all project partners are expected to
provide necessary supporting documents, which may contain personal data (e.g.,
payments, professional fees, logbooks, contracts).
2) Types of Personal Data Personal data in this context may include, but is not limited to:
a. Identity information, such as name, date of birth, address, telephone
number, and nationality. b. Financial data, such as account numbers, salary
slips, and work-related expense receipts.
3) Data Sharing Only staff members of Atma Jaya Catholic University of Indonesia
who require access to project expenditure documentation (e.g., honoraria,
professional fees) to fulfill their roles as project coordinators shall have
access to this data.
4) Project managers will process the data in a secure, well-controlled
archival system with reliable access controls. Data sharing is only permitted
in response to information requests from funders or external audit requests.
5) Data Retention Personal data shall not be retained longer than necessary for the
purposes of processing. After the audit period or the expiration of the
accountability period, Atma Jaya Catholic University of Indonesia will delete
the documents supporting work-related costs unless the retention of personal
data is still required to meet legal obligations.
2. Data Subject Rights Data subjects in the
context of RCD data processing include donors, RCD participants, and third
parties. Their rights are as follows:
a. Donor Rights Donors may request
access to or correction of their personal data stored or controlled by Atma
Jaya Catholic University of Indonesia. Donors can submit such requests through
LPPM of the university.
b. b. RCD Participant
Rights RCD participants are informed of their specific rights through
a document provided at the start of the activity. This document includes
contact details for the person in charge, should participants wish to exercise
their rights. In principle, research participants are entitled to access and,
if necessary, correct their data processed in the context of RCD. The document
also outlines the purpose and legal basis for the data processing. If data is
processed based on consent, participants have the right to withdraw consent at
any time. Withdrawal of consent does not affect the validity of prior data
processing. However, in some research contexts, the exercise of certain data
subject rights may be limited due to the potential adverse impact on the
research goals.
Third-Party
Rights Any
third party whose personal data is processed in the context of RCD
collaboration has the right to review and, if necessary, correct their