Task emails and essential role-based communications

The restrictions that apply to marketing communications such as newsletters do not apply to the type of emails that are essential for a Cochrane contributor to carry out their role.

Examples include:

Workflow emails within Editorial Manager, Engage, or other Cochrane systems
Personal emails to named individuals about a specific task
Essential updates to all people with a certain role about a new Group policy

Editorial Manager should be used fully at all stages of review production. When you store data in Editorial Manager, you do not need to worry about data protection compliance. Data in Editorial Manager are Cochrane’s responsibility.

When sending emails, try not to send any attachments which include personal data. If this is unavoidable, use a password protected file and send the password in a separate email.

If you are uncertain whether a planned email message requires consent or not, please contact support@cochrane.org.

Editorial processes

At specific points in the editorial process, editorial base staff need to handle personal data. Best practice guidelines on how to do this are detailed in the table below.

Process	Specific Action	Why might this be a data protection issue	What can your group do to protect personal data?
Getting involved request	Adding new Group contacts and authors	Do not add people to mailing lists / databases without allowing them to confirm communication preferences	Encourage people interested in your Group to create their own Cochrane Account. This avoids the need for collecting personal data on Group contact forms. New authors and peer reviewers can add / edit their own affiliations and other details as necessary, in Editorial Manager and / or in their review in RevMan. If you create new Group contacts, ensure you delete any Group contact or registration form once the personal data are stored in Archie.
Peer reviewers	Storing details of potential peer reviewers	Storing full contact details of potential peer reviewers without their knowledge could breach their data protection rights	Store all peer reviewers’ details in Editorial Manager. If you wish to make a note of a peer reviewer’s details before creating their contact record and Cochrane Account, please add a manuscript note against the manuscript in Editorial Manager to include a link to a potential peer reviewer’s publicly-available online academic or professional profile.
Peer reviewers	Storing peer reviewer comments	Peer reviewers’ Declarations of Interest are personal data with all the associated rights attached	All peer reviewer comments should be collected via the forms in Editorial Manager. If someone wants to know what data we hold about them or wants us to erase all data we hold on them we can only do this if it is centrally stored. Editorial Manager stores peer review forms and these are securely backed up, so there is no need to store copies locally.
Peer reviewers	Storing research interests of peer reviewers	Information about peer reviewers’ interests is personal data and should be processed in accordance with GDPR	Store this information in Editorial Manager, for example in a Note on the person record, OR encourage them to create a profile in Engage where they can showcase their interests and skills.

If you have further questions please contact support@cochrane.org.