Types of assessments of the notification form

When you have submitted a notification form for personal data, you can receive different assessments from us, depending on the privacy disadvantage and the risk in the project.

Based on the information researchers and students fill out in Sikt's notification form for personal data in research, they will receive one of the following types of assessment from us:

The notification form is reviewed by an adviser who gives an assessment, usually within 30 days.

In the case of a standard assessment, an adviser reviews the information letter and other attachments.

f the processing of the personal data has a high disadvantage and risk for the privacy, there may be a need for a Data Protection Impact Asessment (DPIA).

The notification form is assessed automatically, without an adviser reviewing the registration form. This only applies to the projects where the prosessing of personal data has a low privacy disadvantage and risk.

These project will receive an assessment on the same day that the registration form is submitted.

Attachments to the registration form are also not reviewed manually by an adviser. The student/researcher must ensure that the information letter contains legally required information. This can e.g. is done by using our templates for information letters.

You can read more about automatic assessment further down this page.

If you have several student projects with the same theme, short duration and low privacy disadvantage, these can be notifyed together. Sikt will then assess these projects in a joint assessment.

Joint assessment is mainly relevant for annual studies and bachelor's projects.

To do a joint registration, the subject or subject manager must take on the responsibility as project manager.

Special information concerning automatic assessment

Automatic assessment is only given to institutions that have an agreement to that effect.

We have tested automatic assessment for a long period prior to implementing the functionality in November 2022.

Monitoring of the system

Since automatic assessment is a relatively new functionality that is still under development, we monitor the system and take numerous random samples.

If we see errors or omissions in the notification form, and discover that the project has a higher risk than what is registered, we will withdraw the assessment and give a standard assessment.

Screening of projects for automatic assessment

Several criteria and checks in the notification form are involved in computing a low privacy disadvantage and risk score.

The criteria are detailed, but the most important are:

  • The project does not process special categories of personal data
  • The duration is limited in time
  • The number of data subjects is low
  • All of the data subjects receive individual information
  • The data subjects are over 15 years of age

Incorrect information in the notification form

The most common errors we find when we take random samples are:

  1. The project processes special categories of personal data (sensitive information), but has not ticked for it in the notification form.
  2. Somewhat incomplete information in the information letters, e.g. that the contact information for the institution's data protection officer is not included.
  3. Failure to register third parties (persons that participants talk about).
Read more about what Sikt will asess in the notification form

Contact with Sikt's Data Protection Services