Frequently Asked Questions

Taking into account the current legislation on research ethics in Spain and the European Union, as well as the Ethical Declarations of Helsinki and Tokyo, the Bioethics Declaration of Gijón, of June 24, 2000, the recommendations of the World Health Organization and the Policy on Scientific Integrity and Good Research Practices:

Any research and/or teaching activity carried out at the UPV, either at the initiative of a member of a Department, Institute, Center, under subcontracting or even led by other institutions, but with the participation of the UPV and whose experimentation and/or research or teaching activities have ethical or biosafety implications must be previously authorized by the Research Ethics Committee of the UPV (hereinafter CEI-UPV).  Thus, those projects that involve:

• clinical experimentation,
• experimentation with human cells and tissues,
• experimentation with human embryos and gametes,
• non-clinical experimentation with humans (intervention and observation),
• collection and/or processing of personal data,
• animal experimentation,
• experimentation with genetically modified organisms
• experimentation with biological risk agents,
• experimentation in the field of neuromarketing,
• experiments that may endanger the safety and health of researchers,
• research for military purposes, and
• research involving the development, deployment or use of Artificial Intelligence based on personal data or for human applications.

Must have express authorizationex-ante issued by the CEI-UPV. An ethical evaluation cannot be made when the research has already begun.

First, access the section How do I start the procedure? and once there, select the corresponding form. In the case of addenda to a project already submitted, use the form 8 and in the case of projectsalready approved by another Research Ethics Committee, the form 9.

These forms are updated when the CEI-UPV deems it appropriate, therefore, it is advisable that thedownload from the website each timethat you are going to submit a proposal and thus ensure that you have the most up-to-date version.

In addition, it is advisable to consult the following forms:

• Instructions for completing form 2
  • Informed consent
  • Data processing consent form
  • Activities with ethical implications
  • Example of an information sheet

Once the evaluation application has been completed, it must be signed by electronically by the IP. In absolutely exceptional cases, an original analog signature may be accepted together with the seal of the department or center. This will require prior justification to the IRB. The form, together with the attached documentation according to the type of project, must be sent to the following e-mail address comite.etica@upv.es

The IRB generally meets monthly, with the exception of August. The deadline for submitting projects is available on the IRB website:

The reception of projects will be closed on a monthly basis.last business Monday prior to the week in which the Committee meeting is held, according to the calendar published on the web site of the Research Ethics Committee (IRB).

If the project is submitted after the monthly meeting deadline, it will be evaluated at the next meeting.

The committee secretariat must gather all the reports from all the evaluation members before being able to issue the reports, so the procedure may take some time. Generally, if the project needs to be corrected, you will receive an email with the requirements within ten working days after the meeting. Priority is always given to sending requirements, rather than favorable reports. Favorable reports can generally take up to fifteen working days after the meeting.

These are indicative deadlines; due to the changing workload, deadlines may be extended.

You can see all the phases here. Please note that approximately 70% of the projects usually require a second review, so it is suggested to send the projects with the necessary time in advance.

Make the necessary changes to the research project and fill out the form 7. You will need to redeliverall the information of the project (not only what has been changed) and explain in form 7 everything that has been corrected. The form must be electronically signed.Failure to do so will result in the proposal not being reviewed by the evaluators.

Always:

• Participant Information Sheet
• Informed consent form

If the project includes participation of minors or vulnerable groups:

• Personal data processing impact report

Whether interviews, surveys or questionnaires are conducted:

• ALL questionnaires to be used in the study.

If it involves human clinical data or clinical experimentation:

• Approval of the Protocol by the CEIm of the center in charge of recruiting the participants.
• Contract or document of data transfer from the data owner to the UPV.

The CEI-UPVNOis a Research Ethics CommitteeClinic(CEIm) and, therefore, its evaluation of projects related to medicines or medical devices will not have the same validity as that of a CEIm before the AEMPS, nor before the Notified Bodies.

Yes, all the information required in the Application Form must be completed regardless of whether it is contained in an attached document.

It should specify who is/was in charge of recruiting the participants, the inclusion/exclusion criteria, the recruitment process, and the sample size. It should also be made explicit how a balanced and representative sample of the population to be studied will be guaranteed or, alternatively, the lack of representativeness of the sample should be justified.

If it is foreseen that different types of participation will take place, the recruitment should describe which participants will participate in one modality or another. Finally, describe how participants will be recruited (databases, advertisements, collaborators, etc.).

The favorable report from the center where the recruitment of the trial subjects is carried out must be submitted and a letter of commitment to participate in the recruitment from the agency in charge of such recruitment must be attached.

In the case of studies with patients of any of the following types of patientshospital or health centerThe favorable report of the CEIm of that hospital or of the entity that the hospital decides must be submitted.

Please note that you can opt for an abbreviated procedure. In this case you must fill in form 9 and provide ALL the documentation that was provided to the IRB in question, where it is clear your participation in the project, as well as the favorable report of the same.

The following should be includedALL the variables to be analyzed in the study.
And these variables must be theminimums essential for the achievement of the project objective, avoiding increasing the number of variables without obvious justification. In the case of including variables related to the person’s state of health, these must be adequately justified.

If part of the variables are derived from a questionnaire, it is not necessary to include all of them, but to refer to the questionnaire in question.

If the questionnaire includes questions that could be considered intrusive or sensitive, there should be an option not to answer and, in any case, it is advisable to clearly justify the need to obtain information such as level of education or income level. Remember the principle of minimization of personal data, which establishes that only personal data that is essential for the intended purpose should be collected and processed.

In the case of conducting student surveys in the framework of research projects, GVA has sent the following surveys instructions.

In demographic questions, in case of asking about sex, the intersex option should be added. It is common to confuse gender or sex questions or answers. Please check it.

The Information Sheet should give specific details of the objectives of the project, indicating what is to be done and what it is for. They should contain explicitly what activity the participant is to perform and the rewards he/she might get for them. Therefore, in complex projects with several activities, in addition to a general information sheet, an information and consent sheet is required for each activity. The information sheets should be understandable to any layperson.

A usual structure of the information sheet includes:

• Project title.
• Person responsible for the investigation
• Funding sources and direct beneficiaries
• Invitation to participate
• Purpose of the study
• Voluntary clause
• Direct or indirect expected benefits
• Risks and costs of participating in the study
• Other alternatives to participation
• Procedures or activities to be performed
• Compensation for participation
• Access to results
• Provisions regarding data management
• Contact information for more information

Please take into account the following aspects when drafting it:

• If minors participate and it is necessary to generate an information sheet adapted to their level of understanding. In general, if the participants are under 12 years of age, it is understood that a sheet for guardians and another adapted for minors will be necessary. In the environment 12-18 years will depend on the complexity of the sheet.

• The duration of each phase of the test and the estimated time of the complete test should be indicated.

• It should include information on ALL funding entities of the study (public, private) or entities that will directly benefit from the results of the study. It is not sufficient to indicate the reference of the funded project.

• Please note that the information and consent forms must be consistent, i.e. the data on the information form and the consent form must be identical.

• The voice or image recording itself implies personal data and will require explicit consent, as well as a description of why it is necessary, what it will be used for, how long it will be stored, whether it will be transcribed and destroyed, whether it will be anonymized (e.g. pixelated), whether it will be disseminated (e.g. in the dissemination of results, advertising…) or whether it can be transferred to third parties.

• In the event that it is indicated that the results will be shared with the participants, it must be made explicit how this transmission of information will be carried out (by collecting emails, directing to a web page…).

• It is recommended to include a voluntariness clause similar to “.can freely decide whether or not to participate in the study, and can withdraw at any time without any negative repercussions and without the need to provide explanations.“.

• In the case of contracting insurance, detailed information on this insurance must be included.

• Both the participant information sheet and the informed consent form should be written according to the reading comprehension skills of the participants, especially in the case of adolescents and the elderly.

All research staff must commit to follow the “Ethical Guidelines for Trustworthy AI” of the European Commission’s Independent High Level Expert Group on Artificial Intelligence (2019), the guidelines of the European Commission’s White Paper on Artificial Intelligence (2020) and the guidelines of the EU AI Act (2024); as indicated in section 7 of the human interaction or experimentation project form.

How do I know if my project is anonymized or pseudonymized?

The key difference between anonymized and pseudonymized processing lies in the possibility of directly or indirectly identifying individuals from the processed data:

• A project is considered anonymized when personal data has been transformed in such a way that identifying individuals is impossible, even when combined with other sources of information. Anonymization must be irreversible and effective. In these cases, the GDPR does not apply, since the data is no longer considered personal.
• A project is considered pseudonymized when personal data has been transformed (for example, by replacing names with codes), but there is additional information that would allow the identification of individuals (such as a correspondence list). In this case, the data remains personal, and the GDPR does apply.

Additionally, it is important to consider the risk of reidentification, especially in research involving small samples, very specific data (such as artists or patients with rare diseases), or combinations of variables that could indirectly identify a person. Even if the researcher does not intend to identify anyone, if there is a reasonable possibility that participants could be reidentified, the data should be considered personal data.

In this regard, it should be understood that in cases where we store a record of informed consents identifying participants and subsequently, as part of project management, assign them an internal code to unlink their identity from the processed dataset, the processing will be considered pseudonymization. This measure, regulated by Article 4.5 of the GDPR, contributes to the security and confidentiality of the processing but does not imply that the data becomes personal or anonymized, since there remains a technical possibility of reidentification through the additional information held by the data controller.

Conclusion: If there is any possibility of linking the data to an identifiable person, even indirectly, the processing must be considered personal data and all GDPR safeguards must be applied.

In case of doubt, you can always consult the Data Protection Officer at dpd@upv.es..es.

Foranonymize personal data effectively in a research project, it is necessary to apply techniques that will ensure thatpeople can no longer be identifieddirectly or indirectly, not even by using reasonably accessible additional information.

Key steps for anonymization:

1. Remove direct identifiers: Such as name, ID, address, telephone number, e-mail, facial images, voice, etc.
2. Remove or modify indirect identifiers: As a combination of variables that can identify a person (e.g., place of residence + profession + date of birth). This may involve:
   • Group values (e.g., by age intervals).
   • Generalize data (e.g., “geographic area” instead of “municipality”).
   • Delete unnecessary data.
3. Reduce data granularity: Avoid including information that is too specific to allow identification.
4. Remove keys or links that allow re-identification: If you keep a linking code with the identity of the participants, the treatment remains pseudonymized, not anonymized.
5. Assess the risk of re-identification: Analyze whether, by combining the data with other accessible sources, a person could be identified. If there is a reasonable risk of re-identification, the data is not truly anonymized.
6. Apply additional techniques if necessary: As themasking,randomization,permutation odifferential privacydepending on the type of data and context of the study.

Important: Anonymization must be irreversible. A simple deletion of the name does not guarantee that the data are anonymized. In addition, once anonymized, the dataare no longer subject to the GDPRbutyou will not be able to re-identify them or contact the participants afterwards.

The basic guide to data anonymization can be found at here (october 2022, aepd, spanish data protection agency). The basic anonymization tool can be consulted at here (September 2023, aepd).

The form must clearly indicate the pseudonymization or anonymization procedure, as the case may be. If you have any doubts, you can always contact the data protection officer at the following e-mail address dpd@upv.es.

If, in accordance with the form provided by the Research Ethics Committee (REC), you have determined that your project requires aData Protection Impact Assessment (DPA)If you are not sure of the correct preparation, you must follow the steps indicated below:

1. Document data processing

You must describe:

• Thepurpose of treatment.
• Thecategories of personal data involved.
• Theaffected group.
• Possibletransfers opublications of data.
• Theused technology at each stage of processing (collection tools, storage, analysis, dissemination, etc.).
• Thetreatment life cycleThe data will be used from the time it is collected until it is destroyed or archived: collection, storage, use, disclosure, retention and deletion.

2. Analyzes necessity and proportionality

Explain why the processing is necessary for your research and how it complies with the GDPR principles: data minimization, purpose limitation, proportionality, time limitation and confidentiality.

3. Identifies and assesses risks

Details thepotential risks for the rights and freedoms of individuals, such as:

• Unauthorized access.
• Loss of confidentiality or availability.
• Re-identification of individuals from pseudonymized data.
• Possible discrimination or reputational damage.

Each risk must be assessed on its ownprobability ygravityobtaining an overall risk level. The use of a risk matrix is recommended.

4. Establishes mitigation measures

Describes thetechnical and organizational measures adopted:

• Pseudonymization or anonymization.
• Clear and specific informed consent.
• Encryption, secure storage and backup.
• Access restrictions.
• Registration of activities and traceability.
• Formation of the research team.

5. Forwarding to the Data Protection Officer (DPO) prior to the IRB meeting within a reasonable period of time (10 working days):

All this information should be sent toUPV Data Protection Delegate (dpd@upv.es)who:

• It will analyze the proposed treatment.
• It will assist you in the elaboration of the EIPD.
• Verify the adequacy of the measures adopted.
• It shall determine, if applicable, the need for prior consultation with the AEPD.

The EIPD must be completed and validated before the actual processing of personal data can begin.

If your project involves the treatment ofnon-anonymized personal datai.e., data that directly or indirectly identify the participants, you are obliged to comply with the requirements set forth in theGeneral Data Protection Regulation (GDPR) and theLOPDGDD.

Main obligations to be taken into account:

Legal basis for processing

You must identify what basis legitimizes the processing, most commonly in research:

• Theexpress and informed consent of the participant.
• In exceptional cases, public interest or legitimate interest (requires additional analysis).

2. Information to participants

Before collecting the data, you must inform the persons concerned in a clear and complete manner (art. 13 RGPD), indicating:

• Who is responsible for the treatment.
• For what purpose your data is collected.
• What type of data will be processed.
• If they are to be assigned or published.
• How long they will be kept.
• What rights they have (access, rectification, deletion, opposition, etc.) and how to exercise them.

This must be stated in a document ofinformed consent signed by each participant.

Minimization and proportionality

You can only collect thestrictly necessary data for the purposes of your research. Avoid excessive data or data that do not provide real scientific value.

4. Treatment safety

You must implement appropriate technical and organizational measures, such as:

• Pseudonymization or data encryption.
• Access control to files or devices.
• Backup copies.
• Secure storage environments (never personal or unencrypted).

5. Registration and documentation

Treatment should be documented, including:

• A description of the treatment.
• The security measures applied.
• If applicable, the Impact Assessment (EIPD).

6. Avoid uncontrolled reuse

The data collected cannot be reused in new projects without:

• Inform the affected persons again.
• To have an adequate legal basis.
• Ensure compatibility of purposes.

7. Consultation with the DPD

It is recommended thatinform and consult the UPV Data Protection Delegate (dpd@upv.es). from the design phase of the project, especially if sensitive data are involved or if there are doubts about the safeguards to be applied.

According to theArticle 13 of the GDPRWhen personal data are collected directly from data subjects, the researcher must provide them, in a clear and accessible manner, with information on the following:

• Identity of the data controller.
• Purpose and legal basis of the processing.
• Recipients (if there will be data transfer).
• Conservation period.
• Rights of participants.
• Possibility to withdraw consent.
• Contact details of the Data Protection Officer (DPO).

This information must be recorded in ainformed consent formor as aseparate clausewhich the participant must read and sign.

Example of an informative clause:

In accordance with Regulation (EU) 2016/679 (RGPD) and Organic Law 3/2018 (LOPDGDD), we inform you of the following:

The person responsible for the processing of your personal data is thePolytechnic University of Valencia (UPV)CIF Q4618002B, address at Camino de Vera s/n, 46022 Valencia. You can contact the Data Protection Delegate by mail:dpd@upv.es.

Your data will be processed for the purpose of [specify: e.g., “conduct an academic research study on…”within the framework of the project entitled [indicate name of projectWe may not use or disclose your personal information to third parties without your prior written consent.

The legal basis for the processing is yourexpress consent (art. 6.1.a of the RGPD). Your data will not be disclosed to third parties unless required by law and will not be used for purposes other than those described.

The data will be kept for the time necessary for the purposes of the research and, after the end of the project, will be stored in the database.specify: anonymized/deleted/archived according to regulations].

You may exercise your rights of access, rectification, erasure, objection, restriction of processing and portability by contactingdpd@upv.esor through the UPV’s electronic headquarters. You also have the right to file a complaint with the Spanish Data Protection Agency ( www.aepd.es).

You may withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

• 1.Put at the beginning of the survey informs the following, or similar, filled in:

The objective of the present investigation is xxxxxxxxxxxxxxxxxxxx. In addition, we want to know xxxxxxxxxxxxxxxxxxxxxxxxxxxx. The result of this research should be useful for xxxxxxxxxxxxxxxxxx.

To do this we need you to answer this questionnaire completely anonymously. Answering these questions will take you about x minutes. Your participation in this research is completely voluntary. You can decide not to participate or discontinue participation at any time without giving any explanation.

Your help will help us to xxxxxxxxxxxx. The results may be disclosed in aggregate xxxxxxxxxxxxxxxxxxxxxxx. Please note that no personal data is collected that could allow to identify the answers.

This survey is an initiative of the xxxxxxxxx of the Universitat Politècnica de València,without specific financing (put if financing is available). If you have any questions you can resolve them by writing to the coordinator xxxxxxx xxxxx (xxxxxx@upv.es). Once the research is concluded you will be able to access the general results through xxxxxxxxx (indicate if you can request the results to be sent by mail or you will be able to access them through a specific web site).

By selecting the option I agree to participate in the research you are declaring that you are aware of the purpose of the research, the tasks we ask you to perform and the use that will be made of the information collected and that you agree to participate in the research on a voluntary basis.

• 2. Add the following question at the beginning of the survey:

I understand the purpose of the study and the use of the data collected. I give my consent to participate in the study. Please select one option (options should be “Yes (skip to next question)” or “No (skip to end of survey)”).

REMINDER: ALWAYS DISABLE THE OPTION TO ENTER EMAILS TO FILL IN THE SURVEY.

If the study involves any of the cases that appear on the “Does my project have to go through the University Ethics Committee?”section, then it would be necessary. Probably the person responsible for the research has already authorized the project in which your work is carried out. In this case, you should simply include the project authorization data in the methodology. If this is not the case, your project director should fill in the form and request authorization.

You can select that you have NOT gone through the ethics committee and fill in a responsible statement that you will do so at a later stage. Note that this does not exempt you from submitting the project at a later stage, when you have the structure of the research delimited, and alwaysformerly to conduct the part of the research that has ethical or biosafety implications.We will not be able to carry out an evaluation when activities with ethical implications (e.g., data manipulation, interviews, surveys, animal experimentation, etc.) have already begun, with all that this may entail.

In the thesis, the director of the thesis must always appear as the PI.

No. The vast majority of prestigious journals require a favorable report from the Research Ethics Committee of the researcher’s university in order to publish the article.o, so you may find yourself with an approved, peer-reviewed article in a highly prestigious journal andNOT able to publish it without a PRIOR favorable report from the Committee.. These cases – much more frequent than they may seem – do not provide an exception to the rule,an ethical review cannot, under any circumstances, be carried out when research has already begun.