Dear All,

As you know, most of the imaging data we collect at YNIC is potentially biometric. As well as making sure we have appropriate consent from participants, we have to abide by certain legislative requirements relating to collecting, storing and sharing personal data. We've put in place some procedures to make things easier. What you need to know is summarised below and there's a diagram attached (it contains the same information but with boxes and arrows!) Any questions, please ask.

Please also be aware that we have a new page for YNIC forms https://www.york.ac.uk/psychology/research/york-neuroimaging-centre/forms/, where you will find new versions of the participant information sheet and study-specific consent form (we're now on version 9 for both).

Best wishes, Fiona and Andre

*Collecting data at YNIC and keeping it at YNIC*

- Before submitting your ethics application, you need to check whether your study needs a separate *Data Protection Impact Assessment (DPIA)*, or whether it is covered by DPIA_183 v2 https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/YNICDPIA183.pdf (found on the new YNIC forms webpage https://www.york.ac.uk/psychology/research/york-neuroimaging-centre/forms/). If it is not covered by DPIA_183 v2, there's a DPIA screening tool here https://www.york.ac.uk/records-management/dp/dataprivacyimpactassessments/ .

- If it is covered by DPIA_183 v2 https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/YNICDPIA183.pdf, make sure you follow the procedures outlined in that document.

- Make sure everyone with access to the data has signed and submitted the *Appropriate Data Usage Declaration* https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/AppropriateDataUsageDeclaration.pdf .

*Bringing into YNIC data that were collected elsewhere*

- You will need to complete and submit your own DPIA, but we have had one of these approved already, so contact Andre and he will provide you with a template.

- If there are any agreements to sign, you will need to get HOD approval before signing.

*Transferring data collected at YNIC to external collaborators*

- You will need to complete and submit your own DPIA, but we have had one of these approved already, so contact Andre and he will provide you with a template.

- You will also need an external collaborator agreement. We have had one approved already. Andre can provide a template and let you know the procedure for obtaining approval from the HOD and the contracts office.

- Make sure everyone with access to the data has signed and submitted the *Appropriate Data Usage Declaration* https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/AppropriateDataUsageDeclaration.pdf .

*Transferring data collected at YNIC to former staff or students*

- You will need to complete and submit your own DPIA, but we have had one of these approved already, so contact Andre and he will provide you with a template. (It's the same template as used for sharing data with external collaborators).

- You will also need a data sharing agreement. This is not the same as the one used for external collaborators. We'll have a template soon, which Andre will be able to provide. The procedure for obtaining approval from the HOD and the contracts office will be the same.

- Make sure everyone with access to the data has signed and submitted the *Appropriate Data Usage Declaration* https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/AppropriateDataUsageDeclaration.pdf .

*Making data collected at YNIC publicly available* (many thanks to Angela for this)

- Make sure that this is covered by DPIA_183 v2 https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/YNICDPIA183.pdf and you abide by the procedures outlined in that document. This includes making sure you use version 9 of the information sheet https://www.york.ac.uk/psychology/research/york-neuroimaging-centre/forms/and version 9 of the consent form https://www.york.ac.uk/psychology/research/york-neuroimaging-centre/forms/. There is a guidance document here https://vcs.ynic.york.ac.uk/ynic-public/forms/-/raw/master/Open_Data_Sharing_YNiC_guidance.pdf .

- If it is not covered by DPIA_183 v2, you will need to complete and submit your own DPIA https://www.york.ac.uk/records-management/dp/dataprivacyimpactassessments/ .