Document the actual data flow.
- Identify the research decisions
Record who determines the purpose and means of the processing. Partner roles depend on what they actually do.
- Limit the requested information
Connect each personal-data field to a research purpose. Consider whether aggregation or a non-identifying code can meet the need.
- Prepare participant information
Explain the organisation, purpose, use, recipients, retention and contact route in language participants understand.
- Review processing and transfers
Consider the platform agreement, subprocessors and AI operations separately from the location of the main database.
- Plan access and publication
Separate raw-response access from a partner report or a public chart. Review quotes, audio and small groups.
- Plan requests and retention
Assign responsibility for participant requests, reminders and authorised destruction.
- Keep the record
Preserve the notice version, study version and relevant decisions so the process can be explained later.
Controller responsibilities remain part of the project.
The Nuvopoll data protection tools support the survey owner with notices, approval records, retention reminders, requests and audit records. They do not replace the legal assessment of the particular research.
The EDPB distinguishes the controller who determines purposes and means from the processor acting on instructions; each has responsibilities. Assess the actual partnership arrangements rather than assigning a role solely from a project title.
A practical publication example.
A partner may need aggregated training feedback, while the evaluation team needs a more detailed working dataset. A public report may require additional suppression of small groups and identifying quotations. Design those views separately.