During their studies, students complete Case Studies as an integral component of their regulated qualifications. This process involves collecting comprehensive consent forms and detailed medical history information from participants, which must be securely retained for a minimum of seven years in accordance with legal requirements and insurance provider policies.
While GDPR compliance is occasionally overlooked in educational settings, it’s important to recognise that students are actively collecting and processing personal data from their case study participants. This information must be handled, stored, and protected in full compliance with ICO guidance to ensure data security and privacy standards are maintained.
Following recent clarification from the ICO, all students are required to implement a comprehensive GDPR/Privacy Policy when handling any client data, including information collected during case studies. Given that students will be documenting sensitive health information, they will likely need to register with the ICO as data controllers, as required by law.
Please be aware that failure to register when legally required could result in financial penalties. We encourage all students to review their data handling practices and ensure full compliance with current data protection regulations.
For guidance on ICO registration and GDPR compliance, students should consult the ICO website or seek advice from their course administrators.
Visit the ICO’s website for further information:
What is Personal Data?
The Right to be Informed
Data Protection Fee
Or visit the AoR’s GDPR page for more information and support.
