The Data Protection Officer (DPO) is the point of contact for all enquiries regarding the processing of personal data at the University of Koblenz; the DPO is independent of management and bound by a duty of confidentiality. The DPO advises all members and affiliates of the University, as well as all individuals affected by the University’s data processing activities.
To check whether and to what extent your project is subject to further data protection regulations, you can find out more here and use an interactive wizard to assess its relevance under data protection law: Data Protection in Research.
Where in doubt, the Information Security and Data Protection Officer to contact.
By using the application form available on the linked page, you can gain access to DPMS to create and maintain a record of processing activities (register of processing activities) as well as other documentation required under data protection law.
https://uni-ko.de/vvt
The data you enter will be sent to the Information Security and Data Protection Unit, and access to DPMS will be granted following an examination. Should you have any queries, the authorised representative for Information Security and Data Protection will contact you.
The University of Koblenz’s “Policy on Data Protection Organisation” were adopted by the Collegial Presidential Executive Committee on 20 March 2025 and came into force upon their publication on 8 April 2025.
The Policy defines the persons and units involved in the data protection organisation (see, in particular, the principles set out in the preamble) as well as their duties and responsibilities with regard to the lawful processing of personal data in accordance with the provisions of the applicable data protection legislation. The data protection framework described in the policy is based on the various obligations of the University of Koblenz as a data controller within the meaning of data protection law and the associated tasks.
In the ‘Forms and Templates’ section, you will find further forms (e.g. guidance on completing forms, templates for consent forms, and much more): Link
Please note: The purpose of this FAQ is to explain the rules, regulations and legal provisions relating to data protection in clear and simple terms. If in doubt, please refer to the sources/legislation cited for the exact legal texts, or contact the Information Security and Data Protection Officer.
Data protection is about protecting people from harm arising from the collection, processing and use of their data. Individuals should be free to decide which of their personal data they make available, when, to whom and for what purpose. Data protection focuses on the data of individuals, whereas information security concerns the protection of all relevant types of information, regardless of its nature or origin, within an organisation. However, the two topics are closely interlinked.
The relevant legal provisions in this regard are the GDPR (General Data Protection Regulation), LDSG RLP (State Data Protection Act) and Rhineland-Palatinate Higher Education Act (HochSchG RLP).
(The GDPR can also be found in German via the link above, or here via Direct link.)
Put simply, data protection is always relevant whenever data relating to a person is processed (processing of personal data).
(see Article 1 of the GDPR, Article 2 of the GDPR)
This refers to all data relating to a person. Data is considered personal whenever it is, or can be, linked to a person in any way. This may include a name, address, university ID and much more.
As soon as data can be used to identify an individual, or if it contains information relating to that individual, it is considered personal data. Consequently, even indirect data (such as usage logs and the like) may constitute personal data if it allows conclusions to be drawn about specific individuals. Various pieces of information which, when taken together, can lead to the identification of a specific individual, also constitute personal data.
The protection of personal data is an essential part of data protection.
(see Article 4(1) of the GDPR)
Put simply, this refers to highly sensitive personal data, the misuse of which would be particularly serious and which is therefore afforded special protection under data protection law. These are set out exhaustively in Article 9(1) of the GDPR.
This includes, for example, data revealing ethnic origin, political opinions, religious or philosophical beliefs. It also includes genetic and biometric data, health data, and data relating to a person’s sex life or sexual orientation.
(see Article 9(1) of the GDPR)
The processing of such information is generally prohibited, except in certain circumstances. Such data may, for example, be processed where this is necessary for medical diagnosis, where appropriate safeguards under employment law are in place, or where the data subject has given their explicit consent in this regard.
(see Article 9(2) of the GDPR)
The term ‘processing’ is to be understood in a broad sense and encompasses many different conceivable processing steps. Processing begins with the collection of personal data (either directly from the data subject or from third parties), and encompasses its use (e.g. storage, modification or disclosure) as well as its erasure.
(see Article 4(2) of the GDPR)
If personal data is processed within your working group, institution or, more generally, by you as a member of staff at the University of Koblenz, this must be documented in the so-called ‘record of processing activities’ (see: Forms and templates).
(see Article 30(1) of the GDPR)
Under the GDPR, a legal basis is required for any processing of personal data. Such legal bases may be set out in the GDPR itself or in other legislation, such as the State Data Protection Act or the Rhineland-Palatinate Higher Education Act.
(see Article 5(1)(a) of the GDPR, Article 6 of the GDPR)
The data subject is the person whose personal data is collected, stored or processed.
Example: Employees, students
(Article 4(1) of the GDPR)
Where personal data is processed in the context of the university (e.g. by staff or researchers), responsibility under data protection law generally lies with the university itself. As the data controller, it must ensure that processing is organised and technically implemented in a manner that complies with data protection regulations. Staff, researchers and students all share responsibility in this regard and must, in particular, comply with the university’s guidelines (for example, when using the IT infrastructure).
Where there are relevant fields in the privacy statement or the record of processing activities, ‘University of Koblenz’ should therefore be entered on a regular basis.
(Article 4(7) of the GDPR)
Anonymisation of data is only considered as such if it is no longer possible to identify any individuals from the data! Furthermore, there must be no key or ‘translation’ that could be used to determine the original personal associations from the modified data! In the latter case, it is simply a matter of Pseudonymisation.
It should also be noted that any backups of non-anonymised data must also be deleted!
To supplement this topic, the following are data collected anonymously those in which, from the time of collection (inclusive) onwards, there is no longer any link whatsoever between the data subject and the data.
Important: As anonymous data does not allow any conclusions to be drawn about the individuals concerned, the GDPR does not apply to it. In contrast, pseudonymous data constitutes personal data and is therefore also subject to the requirements of the GDPR.
General tips on anonymising data:
(see Article 4(5) of the GDPR and Recital 26)
In legal terminology, the concept of the Consent clearly defined as “explicit prior consent”. Retrospective consent constitutes authorisation. The GDPR deliberately uses the term “consent” to make it clear that the data subject must give their consent to the processing of their personal data prior to such processing taking place. The data subject must therefore be clearly informed in advance as to why and to what extent the data is to be collected and processed. In addition, they must be informed of the existence of a right to withdraw consent and how this right can be exercised. The powers to be granted by consent must not constitute a “blank cheque”, but must remain within the limits set by the legal basis for the processing.
Furthermore, consent is regarded as Opt-in to be designed in such a way (i.e. the data subject must actively consent to the processing/collection) and not as an opt-out (the data subject must actively object to the processing or collection). Silence or inaction is not sufficient to constitute valid consent. The data subject must therefore take active steps to demonstrate that consent has been given.
For the consent to be valid, it must also voluntary be explained (without compulsion). It should also be noted that it no linkage may be imposed. This means that the data subject must not suffer any adverse consequences if they do not give their consent (e.g. exclusion from an event or similar).
In addition to consent, there are other legal bases for the processing of personal data (see Article 6 of the GDPR). Consent is required if no other legal basis applies, such as the fulfilment of the University’s tasks, the performance of a contract or legal obligations.
(see Article 4(11) of the GDPR, Article 6(1)(a) of the GDPR and Article 7 of the GDPR)
The term third country refers to a country that is not bound by the GDPR, i.e. countries outside the European Union and outside Iceland, Liechtenstein and Norway. If data is therefore processed or shared outside the EU/EEA (e.g. through partnerships with non-European universities), it is transferred to a third country. Where there is a connection to a third country, care must be taken to ensure that the European standard of protection is maintained in relation to data transfers to, or access to data from, third countries.
(see Article 44 et seq. of the GDPR; Recitals 101 et seq.)
This is a general principle in the context of information administration. It is based on the simple but effective idea that access to confidential or sensitive information should only be granted to those individuals who absolutely need this data to carry out their specific tasks.
(see Article 5(1)(f) of the GDPR and Article 32(1)(b) of the GDPR)
These are security measures designed to help ensure the secure processing of personal data. Technical measures include, for example, data encryption or the use of anti-virus software. Organisational measures include guidelines and procedures for staff, such as access restrictions to certain premises. Both types of protective measures are necessary to minimise the risk to data subjects.
You too can help to protect sensitive data in your day-to-day work, for example by always locking your office, even during brief absences, and using a password-protected screen lock, storing documents during the working day in such a way that they cannot be viewed, and keeping files in sufficiently secure and locked containers or cupboards.
(You can also find out more about how to protect your data at Useful information on information security)
(see Article 5(1)(f) of the GDPR, Article 24(1) of the GDPR, Article 32 of the GDPR)
The question of what retention period applies is not directly stipulated by the GDPR. This depends on various factors, including the purpose of the data processing and the legal requirements in the relevant context. As a general principle, it is not permitted to process personal data for longer than is necessary for the purposes for which it was collected. Once the purpose of processing has been fulfilled, the data must be erased or anonymised, unless there are legal retention obligations or legitimate interests that justify longer storage. As long as these exist, they take precedence over the obligation to erase data under the GDPR.
Standard retention periods are governed by the relevant legal provisions, which specify the duration of retention; this may vary depending on the type of data.
For some types of data, the retention period is ten years, whilst in other cases it is only one year. This applies regardless of whether the data is stored on paper or digitally.
(see Article 5(1)(e) of the GDPR, Article 17 of the GDPR)
The principles include lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality, and accountability of the controller.
(see Article 5(1) and (2) of the GDPR)
The processing of personal data must be lawful in accordance with Article 6 of the GDPR. This requires a legal basis, and the other requirements (see Principles of data processing) must be taken into account and met.
(see Article 5 and Article 6 of the GDPR)
Under the ‘presumption of prohibition’ principle in data protection, any processing of personal data is prohibited in the first instance, unless it is expressly permitted.
The legal basis is what provides the legal justification for the processing of personal data. The legal basis either arises from an applicable legal provision (a law, regulation, etc.) or from the consent of the data subject. Only where no other legal basis for data processing is applicable can the data subject’s consent serve as a basis for legitimacy.
(see Article 5 and Article 6 of the GDPR)
At the University of Koblenz, personal data is processed in accordance with, amongst other things, the following legal provisions:
Do you use external tools, or do you require additional services for your project, such as specialised online survey tools or external hosting? If so, please remember to ensure that a data processing agreement is in place in good time. Among other things, this agreement governs how the data collected is processed between the University, as the data controller, and the service provider. Please note that, in some cases, the University may itself act as a data processor on behalf of other organisations, for example when data is to be processed on behalf of a project partner. In this case, too, a data processing agreement must be concluded.
Before concluding such a contract, it must be reviewed together with the Contract Cover Sheet submit it to the Data Protection Officer for examination. The Data Protection Officer is on hand to advise you and will assist you in concluding the contract with the external service provider.
Please note that, in accordance with Article 28(3) of the GDPR, data processing on behalf of a controller is not permitted unless a written (including electronic) data processing agreement has first been validly concluded.
Joint controllership applies where two or more independent controllers (e.g. universities) process personal data jointly without there being a hierarchical relationship between them. In this case, the bodies or parties involved are obliged to coordinate their respective rights and obligations and to conclude an agreement on joint controllership in accordance with Article 26 of the GDPR.
Typical examples include research cooperations or joint projects involving various organisations. A key criterion is whether the parties involved jointly determine the purposes (‘what’) and means (‘how’) of the processing. Indications of this may, for example, be found in partnership agreements in which tasks and responsibilities are set out. However, in addition to contractual provisions, the actual processes and the de facto joint determination of the purpose and means of processing are also decisive.
Before concluding such an agreement, it must be reviewed jointly with the Contract Cover Sheet to be submitted to the Data Protection Officer for examination. The Data Protection Officer is available to advise you and will assist you in concluding contracts with the relevant data controllers.
UNIVERSITY OF KOBLENZ
Universitätsstraße 1
56070 Koblenz
© Universität Koblenz
