What does 'processing' mean? Is it just to do with computers? B. What are the basic rules for processing 'personal data'? C. Can someone other than the data subject demand their data from me? What do I do if someone asks me to delete their personal data used in my research? What am I likely to have to do if my research data is subject to an SAR? B. I intend to archive my research data, should I anonymise any personal data before archiving? C. What is 'personal data'? D. Is everyone potentially a 'data subject'? What about children, the elderly and the deceased?

Is it just to do with computers?

GDPR stands for General Data Protection Regulation.

It protects personal data and privacy rights.

No, it is not just to do with computers.

It applies to all processing of personal data, manual or automated.

GDPR = General Data Protection Regulation. No, not just computers.

Yes, but only if you give consent or there is another legal basis (like contract or legal obligation).

They must follow GDPR rules: fair, lawful, transparent.

Yes, with consent or legal basis.

If you explicitly consent, they can use your data for the AR study.

Consent must be informed, specific, and you can withdraw it anytime.

Yes, if you consent specifically.

About children, elderly, and the doctor?

Vulnerable groups need extra protection:

• Children: Need parental consent for data processing.

• Elderly: May lack capacity, extra care needed.

• Doctor: Handles sensitive health data (special category).

Everyone's data must be protected, but these groups have higher risks.

Vulnerable groups: children (parental consent), elderly (capacity), doctor (health data).