Where can I find the current privacy regulations, procedures, and guidelines at Politecnico?
Regulations and operational instructions
Regulations and operational instructions are available on the Statute and regulations page
Procedures, guidelines and templates
Additional useful documentation, such as procedures, guidelines and templates, is available under:
Online Services > Privacy and GDPR > Documenti
(Last updated: November 11, 2026)
Personal data.Why should it be protected, and how?
Personal data is defined as any information that makes it possible to identify a person, either directly or indirectly, such as their first and last name, tax identification number, email address, personal identification code, telephone number, etc.
The protection of personal data is a right established by the Charter of Fundamental Rights of the European Union (Article 8). Respecting this right means protecting individuals from the risk that their rights and freedoms may be violated as a result of the improper use of their data.
This is regulated by EU Regulation 2016/679 on the protection of personal data, known as the General Data Protection Regulation (GDPR), accessible at the link:
Contact
(Last updated: October 16, 2026)
What is the GDPR?
GDPR stands for General Data Protection Regulation (EU Regulation 2016/679), adopted by the European Parliament on 27 April 2016.
The GDPR establishes accountability as the fundamental principle of data protection. This means that anyone who processes personal data must implement appropriate and effective measures to protect individuals’ rights and must always be able to demonstrate that personal data is used in compliance with the Regulation.
The GDPR also establishes that every processing activity must incorporate measures to protect personal data from the outset, rather than retrospectively, and that such safeguards must be applied by default. These concepts are known as privacy by design and privacy by default.
To ensure that personal data is protected in accordance with these requirements, the European Regulation sets out the principles that must always be observed in any processing activity:
- Lawfulness, fairness and transparency : data must be processed lawfully, fairly and transparently in relation to the data subject. The privacy notice is the instrument used to ensure transparency;
- Purpose limitation: personal data may be collected only for specific purposes stated in the privacy notice and may not be used for different or additional purposes;
- Data minimisation: the data collected must be limited to what is necessary for the purposes stated in the privacy notice and must never be excessive in terms of quantity or quality, including where the purpose is scientific research;
- Accuracy: the data collected must be accurate, kept up to date where necessary, and erased when it is no longer required;
- Storage limitation: data may be kept in a form that allows data subjects to be identified only for as long as is necessary to achieve the stated purposes;
- Integrity and confidentiality: the security of personal data must always be ensured by protecting it against unauthorised or unlawful use and against accidental loss, destruction or damage.
Contact
(Last updated: November 11, 2026)
When is personal data processed in the context of research activities?
When is personal data processed in the context of research activities e what are special categories of personal data?
In research activities, personal data processing means that data relating to identified or identifiable natural persons is collected, stored, modified, disclosed, or otherwise handled through similar operations.
Special categories of personal data
Privacy legislation also identifies so-called “special categories” of personal data which, together with data relating to criminal convictions or offences, are subject to additional protection.
Special-category data includes, for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data, data concerning health, sex life or sexual orientation. It may also include images, voice recordings, and information relating to a person’s behaviour or movements.
Contact
(Last updated: November 11, 2026)
What should I do if a research project or contract involves the use of personal data, such as surveys or interviews?
If the research project involves the use of personal data, for example, through interviews or surveys involving individuals and the collection of personal data, photographs, audio recordings or videos, the following steps are required:
- describe the processing activities using the “Form describing research project for privacy purposes”, which must also include an assessment of the level of risk associated with the processing in terms of its potential impact on the rights and freedoms of the data subjects;
- where the risk is high, carry out a Data Protection Impact Assessment (DPIA).
- Impact Assessment Procedure: Online Services > Privacy and GDPR: Legislation and Reference Materials > Documents > Documents > 3. GUIDELINES – PROCEDURES > Impact Assessment Procedure – DPIA;
- prepare an informed consent form and a privacy policy pursuant to Article 13 of EU Regulation 2016/679 (GDPR);
- formally regulate any transfer of personal data to partners or third parties through a joint controllership agreement, data-sharing agreement, or appointment as a data processor pursuant to Article 28 of the GDPR;
- in the event of a transfer of data to countries outside the EU, complete a Transfer Impact Assessment (TIA);
- comply with the Politecnico di Milano Regulation on Personal Data Processing and ICT Security and with the Operational Instructions for the Processing of Personal Data
- comply with the minimum IT security measures for the storage and use of personal data in order to ensure its protection and confidentiality.
For all research involving human participants, the University strongly recommends obtaining the prior opinion of the Ethics Committee.
(Last updated: November 11, 2026)
Is personal data processing permitted within research activities?”
Yes, Politecnico di Milano may process personal data in the performance of its institutional duties. The GDPR establishes that the performance of a task carried out in the public interest is one of the lawful bases for processing personal data (Article 6(1)(e)). For the University, a task carried out in the public interest consists in pursuing the institutional purposes set out in its Statute, including research activities.
However, it is not always easy to determine when university research is conducted exclusively for institutional purposes, as it often extends beyond these boundaries. This may occur, for example, in funded research—namely, research carried out with funding obtained from public or private bodies, such as the European Union, ministries, regional authorities, foundations or companies—or under consultancy, teaching or research contracts.
In such cases, another lawful basis provided for by the GDPR may be used to legitimise the collection of personal data, namely consent (Article 6(1)(a)). Obtaining consent from the individuals who provide their personal data is the most common and advisable practice in research activities, particularly in funded research projects, as it ensures a high level of protection for the rights and freedoms of the individuals involved.
Obtaining consent requires the preparation of a privacy policy describing in detail the data collected and clearly setting out the purposes and methods of the processing.
Consent is required when special categories of personal data are processed.
Contact
(Last updated: November 11, 2026)
What is the “Form describing research project for privacy purposes”?
It is a questionnaire prepared by the Privacy Office of Politecnico di Milano that helps determine whether a contract or research project involves the use of personal data and facilitates its assessment from a data protection perspective.
Contact
(Ultimo aggiornamento: November 11, 2026)
How do you draft a privacy policy?
In the context of research activities, the privacy notice must describe which personal data is collected, how and why it is processed, and by whom.
Within the Department’s teaching, research and third-mission activities, the processing of personal data is lawful:
- when it is necessary for the performance of a task carried out in the public interest;
- when the data subject has given consent to the processing.
Participants in surveys, interviews or similar activities must always agree to take part in the project by providing so-called “informed consent”. This consent is obtained by providing participants with an information sheet describing the project.
Consent to the processing of personal data and informed consent may be provided either by signing a paper form or by ticking a checkbox on an online form.
Info
For further information on the content of the privacy notice, please refer to the templates available under Online Services > Privacy and GDPR > Documenti.
Contact
(Last updated: 11 novembre 2026)
Which templates should be used for privacy compliance requirements?
Templates for privacy-related requirements are available on:
- Online Services > Privacy and GDPR > Documenti > 4. MODULISTICA VIGENTE (privacy notice templates, joint controllership agreement, data-sharing agreement, appointment as a data processor pursuant to Article 28 of the GDPR, and appointment as a system administrator);
- Online Services > Privacy and GDPR > Documents > Documentazione per attività di ricerca (privacy policy templates for research activities, analysis form, and process workflow for managing ethical and data protection matters).
Contact
(Last updated: November 11, 2026)
What should be done if the research activity involves the exchange of personal data with partners?
It is necessary to identify the roles of the parties involved, as the applicable compliance requirements depend on such roles:
- Data Controllers: the Politecnico and the partners or clients process personal data for their own purposes, independently and using separate and autonomous methods.
- Joint Data Controllers: the Politecnico and the partners or clients jointly determine the purposes and means of the processing. Joint controllership is governed by a written agreement signed by the parties (Joint Controllership Agreement).
- Data Processors pursuant to Article 28 of Regulation (EU) 2016/679 and any sub-processors:the Politecnico appoints the partner/client to process personal data for the Politecnico’s purposes and in accordance with its instructions, or, conversely, the Politecnico is appointed by the partner/client as a Data Processor on the basis of the partner/client’s purposes and in accordance with its instructions (Appointment as Data Processor pursuant to Article 28 of Regulation (EU) 2016/679).
- Persons Authorised to Process Personal Data: all persons who access personal data in the performance of their activities and who must be duly authorised and instructed (Appointment as Person Authorized to Process Personal Data).
Contact
(Last updated: November 11, 2026)
What should be done if a purchase involves the processing of personal data?
Complete the “Privacy” section of the RDA application by selecting “Yes” or “No” to indicate whether the purchase of the good or service involves the processing of personal data.
Failure to complete the “Privacy” section will prevent the RDA from being submitted.
If the answer is “Yes”, the supplier/service provider must be appointed as a Data Processor pursuant to Article 28 of the GDPR.
Below are some examples of services involving the processing of personal data:
- development and maintenance of websites that involve the management of personal data through the website itself;
- outsourcing of conferences to third-party institutions;
- development of research platforms or applications designed to process data, including personal data.
Contatti
(Last updated: November 11, 2026)