gdpr
How to conduct a GDPR compliant survey if not collecting personal information, e.g. names, but potentially personally identifiable information?
<p>If I were to conduct a survey of members of a public group in the EU (for my own personal interests) what should be considered in order to comply to GDPR regulations?</p>
<p>If the information does not contain any records of who someone is, how can I allow that person to opt-out at a later date? I.e. say someone completes the survey, but then 1 year later asks to be removed, how would I identify which record is theirs?</p>

<p>The GDPR does not generally distinguish personal data based on its level of identifiability, so the general GDPR compliance process would apply. I've outlined a general checklist below.</p>
<p>You're concerned that you might not be able to fulfill data subject requests such as erasure if you can't locate their records. This is <strong>potentially 100% compliant</strong> because the GDPR explicitly accounts for this scenario. Per <strong>Art 10 GDPR “processing which does not require identification”</strong>:</p>
<ul>
<li><p>You are not required to collect, processor, or maintain additional identifying data for the sole purpose being able to comply with GDPR data subject requests.</p>
</li>
<li><p>If you can <em>demonstrate</em> that you're in no position to identify the data subject, then the GDPR rights in Art 15 to 20 do not apply.</p>
<ul>
<li>These suspended rights are access, rectification, erasure, restriction, data portability.</li>
<li>Data subject rights that apply regardless relate to information, objection, and automated decision-making.</li>
<li>(But, even then, the data might be personal data – personal data is any information relating to an <em>identifable</em> person, even if you can't identify them yourself.)</li>
</ul>
</li>
<li><p>However, if the data subject provides sufficient additional information that enables you to identify their records, then those suspended rights apply again.</p>
</li>
</ul>
<h2>GDPR compliance checklist (non-exhaustive)</h2>
<p><strong>Scope and jurisdiction</strong></p>
<ul>
<li>Are you subject to EU GDPR, UK GDPR, or both, or neither?</li>
<li>Are you within the GDPR's Art 2 <strong>material scope</strong>, or covered by one of the exceptions like the <em>household exception</em>?</li>
<li>Are you within the GDPR's Art 3 <strong>territorial scope</strong>?</li>
</ul>
<p><strong>Basics: purpose and legal basis</strong></p>
<ul>
<li><p>What is the <strong>purpose</strong> of processing?</p>
</li>
<li><p>What is the <strong>Art 6 legal basis</strong> for this processing? For example, <em>legitimate interest</em> or <em>consent</em>. A legitimate interest requires that you conduct a balancing test.</p>
</li>
<li><p>What is the <strong>minimal data necessary</strong> to achieve that purpose?</p>
</li>
<li><p>For which <strong>retention period</strong> will you keep the data?</p>
</li>
<li><p>If you will process <strong>special categories of data</strong>, you will also need one of the exceptions from Art 9.</p>
</li>
</ul>
<p><strong>Compliance and security measures</strong></p>
<ul>
<li><p>Which general Art 24+32 <strong>technical and organizational measures (TOMs)</strong> would be appropriate? This also includes things like backups, encryption, or pseudonymization.</p>
</li>
<li><p>If you engage <strong>data processors</strong>, have you signed suitable contracts (data processing agreements) per Art 28?</p>
</li>
<li><p>If you cause <strong>international transfers of personal data</strong>, on what basis (see Chapter V)? This is particularly relevant if you use non-European data processors.</p>
</li>
<li><p>Are you required to appoint a <strong>data protection officer</strong> and/or <strong>representative</strong>?</p>
</li>
<li><p>Are you required to keep Art 30 <strong>records of processing activities</strong>?</p>
</li>
<li><p>Are you required to perform an Art 35 <strong>data protection impact assessment (DPIA)</strong>?</p>
</li>
</ul>
<p><strong>Preparing for data subject rights</strong></p>
<ul>
<li><p>Have you prepared a <strong>privacy notice</strong> per Art 13/14 GDPR? Most notices also include the information from Art 15 GDPR.</p>
</li>
<li><p>Do <strong>exceptions</strong> to the data subject rights apply, such as:</p>
<ul>
<li>Art 10 processing which does not require identification</li>
<li>derogations based on Art 89 processing for archiving purposes in the public interest, scientific or historical research purposes, statistical purposes</li>
</ul>
</li>
<li><p>How do you plan to satisfy <strong>data subject requests</strong>, in particular <strong>access, rectification, erasure, restriction, data portability, objection</strong>?</p>
</li>
</ul>

<p>Just to add to amon's answer, here's are a couple of relevant definitions from <a href="https://uk-gdpr.org/chapter-1-article-4/" rel="nofollow noreferrer">Article 4 of the UK GDPR</a> (emphasis added):</p>
<ol>
<li><p>‘personal data’ means any information relating to an identified or identifiable natural person** (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;</p>
</li>
<li><p><strong>‘processing’ means any operation or set of operations which is performed on personal data</strong> or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;</p>
</li>
</ol>
<p>So, what matters is whether the data you are collecting falls within the definition of personal data. If there is no personal data, then there is no processing for the purposes of the GDPR (the bolded part above).</p>
<p>There are two ways that data can be personal data: (1) it relates to an <strong>identified</strong> person; (2) it relates to an <strong>identifiable</strong> person.</p>
<p>You're not collecting names, so that rules out the first case. Your question is less clear about the second case. In the title you've written that you might collect &quot;potentially personally identifiable information&quot;. What matters is whether it is possible to identify the person from the data that you collect.</p>
<p>You therefore have two options. Either operate outside the scope of the GDPR altogether by not collecting personal data, or comply with the GDPR.</p>
<p>If someone asks for the data to be removed, and you do not hold identifiable information, then there is no need for compliance. If you do hold identifiable information, and the data subject identifies themself (by reference to that information) in the request then you need to comply.</p>
