Skip to content

Legal framework

Submitting data to ELIXIR Luxembourg requires compliance with a robust legal framework designed to protect data subjects, ensure ethical use, and clarify responsibilities for all parties. This section summarizes the key legal documents and procedures involved in the data submission process.

All conditions of service use are concluded in the Hosting and Processing Agreement.

Warning

Please consider that concluding the agreement may take several months.

ELIXIR-LU can request additional documents (if applicable) which can be shared with data users to allow increased transparency and to demonstrate compliance with existing regulations:

  • template of an informed consent form used during data collection
  • supplementary cohort information
  • approval by respective ethics committee
  • de-identification procedure followed in case data is anonymised or pseudonymised
  • ...

Data Access Committee Models

When establishing controlled access to a dataset, the composition and decision-making process of the Data Access Committee (DAC) can follow one of two models:

1. Provider-Led Committee

  • Composition: The DAC is composed entirely of members designated by the data provider. The provider retains full decision-making authority over access requests.
  • Access Policy: The data provider defines all eligibility criteria, use conditions, and review procedures. ELIXIR Luxembourg facilitates the technical process but does not participate in access decisions.
  • Renewal/Closure: The provider-led DAC is responsible for evaluating dataset relevance and making renewal or closure decisions in collaboration with ELIXIR Luxembourg.

2. Joint Committee (Provider + ELIXIR Luxembourg Experts)

  • Composition: The DAC includes both data provider representatives and ELIXIR Luxembourg experts. Each access request is initially reviewed by ELIXIR Luxembourg members.
  • Decision Process:
    • ELIXIR Luxembourg members conduct the initial review and make a preliminary decision.
    • The decision is then forwarded to the remaining DAC members (provider representatives).
    • Provider DAC members have a 3-week veto period to object to the decision. If no objection is raised, the decision is finalized and access is granted or denied accordingly.
  • Access Policy: This model ensures both scientific oversight and provider control.
  • Renewal/Closure: Renewal and closure decisions are made jointly, with input from both ELIXIR Luxembourg and provider DAC members.

Note

In this model, ELIXIR Luxembourg becomes joint-controller under the GDPR due to its active participation on decision making process.

For more information on the process, please refer to the Data Access section

Hosting and Processing Agreement

The Hosting and Processing Agreement (HPA) serves as the principal contract governing the terms of data hosting with ELIXIR Luxembourg. It establishes the access levels, scope of data, roles and responsibilities of all parties, services provided, embargo periods, and other essential conditions. All data submissions and subsequent service provisions are subject to the terms outlined in this agreement.

Warning

The Hosting and Processing Agreement is, as a rule, non-negotiable.

Annexes

  • Annex A – Specific Conditions of Service:
    Defines access level, embargo period, and establishment of the Data Access Committee.

  • Annex B – Technical and Organisational Measures: Details the measures implemented by the University to ensure compliance with data protection and security standards.

  • Annex C – Standard Contractual Clauses (if applicable): Special conditions included in Data Use Agreements when transferring data outside the EU.

  • Annex D – Data and Data Access Policy: Describes the conditions of use, data origin, consortium details, and access rights for consortium members.

A table, list of Data Information Sheets or an export from the data submission system. The description of each dataset includes basic information (title, data types), data protection attributes (sensitivity, level of de-identification) and dataset specific use conditions.

This information will be also advertised in data catalog.

  • [Optional Annexes]
    • Data Access Request Form: A form made available in the data catalogue and completed by data users when requesting access. By default, the standard form is used. For more information, please refer to the Requesting access page.
    • Data Use Agreement: If modifications to the standard Data Use Agreement template arise from service negotiations, the updated template is attached as an annex.