Purpose
GARC treats personal, research, institutional, and sensitive information as an important institutional responsibility.
This policy establishes the principles governing the collection, use, access, sharing, storage, and disposal of information under GARC's control.
Data Principles
GARC seeks to apply the following principles:
- lawfulness, fairness, and transparency;
- defined and legitimate purposes;
- data minimization;
- accuracy;
- appropriate retention;
- confidentiality and security;
- accountability.
Collection and Use
GARC should collect only information reasonably necessary for a defined institutional, research, communication, partnership, membership, publication, or operational purpose.
Personal information should not be reused for materially unrelated purposes without an appropriate basis.
Sensitive Information
Additional safeguards should apply where information involves health, disability, research participation, children, vulnerable persons, or other sensitive matters.
Access should be limited according to role and need.
Security
Appropriate organizational and technical measures should be used to reduce risks including:
- unauthorized access;
- accidental disclosure;
- loss;
- alteration;
- inappropriate sharing;
- misuse.
Data Sharing
Personal or confidential information should not be shared with external parties without an appropriate purpose, authority, and safeguards.
Where third parties process information on behalf of GARC, appropriate responsibilities should be defined.
Retention
Information should not be retained indefinitely without justification.
Retention should reflect:
- the purpose for which information was collected;
- research and publication requirements;
- contractual requirements;
- legal obligations;
- legitimate institutional needs;
- participant or data-subject rights.
Research Data
Research data management should consider:
- access;
- confidentiality;
- documentation;
- preservation;
- reproducibility where appropriate;
- sharing restrictions;
- anonymization or pseudonymization where appropriate.
Data Rights and Enquiries
Individuals may contact GARC regarding questions about personal information held or used by the institution.
Requests will be handled according to applicable requirements and the circumstances of the request.