What does 'processing' mean? Is it just to do with computers? B. What are the basic rules for processing 'personal data'? C. Can someone other than the data subject demand their data from me? What do I do if someone asks me to delete their personal data used in my research? What am I likely to have to do if my research data is subject to an SAR? B. I intend to archive my research data, should I anonymise any personal data before archiving?

Question 1: What does "processing" mean? Is it just to do with computers? Step 1: Define "processing" according to data protection law (e.g., UK GDPR Article 4(2)). Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. Step 2: Determine if limited to computers. No, processing includes both automated (computer-based) and manual operations (e.g., filing paper records). No, processing is not just to do with computers. Question B/C: What are other rules for processing personal data (beyond consent)? Step 1: List legal bases for processing under UK GDPR Article 6. The six lawful bases are: 1. Consent 2. Contract 3. Legal obligation 4. Vital interests 5. Public task 6. Legitimate interests Step 2: Apply to research context. For research, common bases are public task (if public authority) or legitimate interests (balancing individual's rights). Other bases: contract, legal obligation, vital interests, public task, legitimate interests. Question 2: What do I do if someone asks me to delete their personal data used in my research? Step 1: Identify the right. This is the "right to erasure" (right to be forgotten) under UK GDPR Article 17. Step 2: Check exemptions for research. Erasure does not apply if processing is for archiving purposes in the public interest, scientific or historical research or statistical purposes, and erasure would impair achieving those purposes (Article 17(3)(b)). Step 3: Action required. Assess if exemption applies; respond within 1 month. If no exemption, delete the data. Keep record of request. If data anonymised, no longer personal data so right does not apply. Assess for research exemption; delete if no exemption applies. Question 3: Am I likely to have to archive my research data? Is it subject to anonymise personal data before? Step 1: Archiving requirement. Yes, many funders (e.g., UKRI, universities) require archiving research data for reproducibility, often in repositories. Step 2: Handling personal data. Anonymise (remove identifiability) or pseudonymise personal data before archiving to comply with data minimisation and avoid ongoing controller obligations. Yes to archiving; yes, anonymise personal data first.