The GDPR is the EU's general regulation on personal data protection, and it applies to a project regardless of the participant's country whenever data on people in the EU is processed. In a proposal it forms a separate category of ethics issues, and undeclared data processing leads to requirements before the grant is signed.
- Applies
- By data, not by country
- In the proposal
- Ethics issues category
- Anonymised data
- Outside the regulation
- Pseudonymised data
- Still personal data
The regulation applies not by where your organisation sits but by whose data you process. A Ukrainian institution in a European consortium almost always falls within it.
Where it appears in the proposal
Personal data is one of the nine categories in the ethics issues table everyone completes. Ticking "yes" does not complicate your life: it is undeclared processing, surfaced at ethics screening, that produces requirements to be met before signature – and therefore delay.
What to think through
The legal basis for processing and how you obtain informed consent from research participants.
Minimisation – collecting only what the project's purposes genuinely require.
Anonymisation or pseudonymisation – and distinguishing them honestly: anonymised data falls outside the regulation, pseudonymised data remains personal because re-identification is possible.
Transfers outside the EU – a separate question with its own rules, relevant to any consortium with non-EU participants.
Retention periods and how data is destroyed after the project.
Relation to open data
The open science requirement does not override data protection, and there is no contradiction: the principle expressly allows closing what must be closed. Personal data is a classic legitimate ground for restricting access, provided it is justified in the data management plan.
Frequently asked questions
We are in Ukraine. Does the GDPR apply to us?
If you process data on people in the EU, then yes, regardless of where the organisation is registered. In a European consortium that is almost always the case.
We have de-identified the data. Does the regulation no longer apply?
It depends how exactly. Truly anonymised data falls outside the regulation, pseudonymised data does not: if re-identification is possible, the data remains personal data.
Official materials
Sources
- Regulation (EU) 2016/679 eur-lex.europa.eu · checked 27.07.2026
Data current as of 27.07.2026. Verify the terms with the donor’s official portal before applying.
Updated 27.07.2026 · Reviewed by: GetGrant editorial team
