Navigating the GDPR with Innovative Educational Materials

Esther Hoorn, Henk van den Heuvel
Submitted by Karina Berger on

The Project

‘Privacy in Research: Asking the Right Questions’ is an engaging and innovative response to the challenges faced by researchers working with sensitive data. Commended as best practice by the Council of Europe, the project team has developed a portfolio of modular and interactive educational materials designed to help researchers and students navigate the maze of privacy concerns when embarking on research involving personal data covered by the General Data Protection Regulation (GDPR). 

The e-learning material, which includes an online course, a film, case studies and a role-playing exercise, can be used in educational and research settings to teach and explore good practices for responsible research. Participants learn to consider privacy issues from different perspectives and learn to successfully design, implement and embed responsible research methodology in multi- and interdisciplinary research. 

The project is important in the context of open science and the FAIR principles, as it facilitates the responsible sharing and reuse of data that is relevant for a range of research areas, as well as clinical applications to artificial intelligence (AI) and education more widely. It also supports one of the United Nations’ Sustainable Development Goals (SDGs) that CLARIN has identified as key to its mission. 

‘Researchers often see the GDPR as a negative thing, but that is because they don’t know the rules. Privacy in Research shows what is possible within the constraints.’
Henk van den Heuvel
The trailer for the data protection role play.


The brainchild of Esther Hoorn, lawyer and member of the CLARIN Legal and Ethics Issues Committee, the e-learning material was developed with a wider team in order to offer researchers a tool to explore the possibilities of using or sharing personal data in their work. 

Hoorn’s initial idea of developing an interactive role-playing game to simulate the varying viewpoints of different stakeholders during a Data Protection Impact Assessment (DPIA) took concrete shape when she heard about the real-life challenges Henk van den Heuvel was experiencing as a result of his work with pathological speech, and the difficulty of storing and sharing such sensitive audio and video material in a way that is GDPR-compliant. 

The next key moment was a DELAD (Database Enterprise for Language And speech Disorders) workshop on corpora of speech with communication disorders in 2021, which brought together several relevant and connected parties, including the CLARIN Knowledge Centre for Atypical Communication Expertise Centre (ACE) and the Language Archive at the Max Planck Institute for Psycholinguistics, which is a CLARIN B-centre. The work during the workshop led to a video simulating the set-up of a basic DPIA for sharing sensitive patient research data with restricted access conditions. 

‘We did the role play with support staff and ethics board members, because this multi-stakeholder approach with different perspectives is so helpful. It was great to have CLARIN and DELAD on board for this.’ Esther Hoorn

The video shows a meeting of different stakeholders developing a DPIA in order to determine if and under which conditions a dataset with atypical speech samples can be made available for a specific research project in light of the GDPR. The stakeholders present in the role play include representatives of the dataset, a legal expert, an ethics committee member, a language archive, and researchers, illustrating the different perspectives in the process that need to be taken into account. 

Hoorn says: ‘What we want to show is that within the GDPR, there is room for research. But you need to be responsible, and you need to be in line with ethics. Looking at a specific scenario helps to see what kind of measures are good for your scenario. […] It’s obvious now that you need collaboration and a way to harmonise best practices. The GDPR itself will not do that, only communities of researchers can do this themselves.’ 

Role cards for the role-playing exercise.

GDPR can be a particular challenge in the context of open science and reuse. Hoorn says: ‘Researchers are sometimes risk-averse, or think they can no longer conduct research. They need to trust that there is a method to make a careful assessment on the impact of your research. You can make a reference report, and in the long run, you can perhaps make a code of conduct for your discipline, writing down what you’ve thought about. I think this will grow in the coming years.’ 

The video formed the basis for what has become a fully developed educational package. The role-playing exercise has been supplemented by a set of role cards and concept cards (in both English and Dutch) which can be used in the classroom, as well as a teacher roadmap. Students are encouraged to create a DPIA report at the end of the exercise.

Staff and students can also access an online course, consisting of videos, articles, discussion topics, quizzes and links to other relevant materials, with a total study load of six to nine hours, and benefit from well-documented case studies.


The response to the e-learning material has been overwhelmingly positive. The method is already being used for several courses at Groningen University, for instance for the Master in Science Voice Technology (Campus Fryslân). In addition, the team has received interest from abroad, notably from the Open University (UK) for training their PhD students on ethics and data protection. 

The role plays will also continue to be used within the context of DELAD and the ACE Knowledge Centre, with plans to continue the work in the specific context of language and speech pathology. All materials, including guidelines for storage and consent, are available under guidelines at the DELAD website.

‘Research infrastructures can have a huge impact on bringing people together to share their best practices on responsible research. CLARIN creates a platform for exchanging and sharing best practice. It is a community of researchers, technical people and lawyers and ethics people, so all the different perspectives are already in place.’ Esther Hoorn

Hoorn says: ‘The emphasis is on others being able to use the material independently. In principle, it’s a method. And once you understand how you can use it, you can adapt it to your own environment. Specifically for atypical speech, we now have a recording of real stakeholders doing a scenario, and we have a scenario with role cards and an introduction, and all the material on the website that teachers can use with students.’

The Privacy in Research project was commended as a best practice in promoting academic integrity by the Council of Europe. Hoorn says: ‘I think I received this recognition because of the project’s positive, hands-on approach. In my application, I explained that although universities want this positive approach, it can be difficult to find the fun in such things in a university climate, to see that it can be fun to discuss hard cases. It was this can-do approach that made the project stand out.’



‘I am a student in the MSc Voice Technology at the University of Groningen campus Fryslan. The role-playing game gave me the opportunity to test how I would behave in a research project from different perspectives, such as a researcher, a legal specialist, or a research participant. It was a fun way to initiate a research discussion with my co-students and help each other understand the importance of privacy and gain confidence in our personal projects when asking for participants' help. The game is well designed and allows us to enrich the discussion with the help of topic cards. In this way we could keep the conversation going and think of scenarios in which our research project would succeed while respecting privacy and ethics. GDPR is not a scary monster after this game.’ Spyretta Leivaditi 
‘In the past, I tried to avoid a data protection impact assessment when this came up in the ethical self-evaluation of a European project. Now I understand the added value of this method. The multi-stakeholder approach can help to build compliance into the research design.’ Dr. Nicola Bessell, University College Cork

Esther Hoorn, Legal Advisor, University of Groningen 

Dr Henk van den Heuvel, Director Centre for Language and Speech Technology, and Head Humanities Lab, Faculty of Arts, Radboud University