During the preparation phase, researchers lay the foundations of the research by implementing all the preparatory work for the research activity.Controllers shall take the following actions:

• Appoint a Data Protection Officer
• Identify the data collection approach
• Identify the most appropriate legal basis
• Create a repository for supporting documentation
• Verify if a Data Protection Impact Assessment is necessary
• Perform a DPIA (if necessary)
• Implement risk mitigating measures