Information for participants in research projects

When you collect information for a research project, you generally have a duty to provide information to the participants. The participants are the person or persons you collect information about, also called the sample or the data subjects.

Read more about the requirements that apply to the information you provide, and find templates for an information letter.

The right to obtain information about the handling of personal data is enshrined in the General Data Protection Regulation (GDPR).

This is a fundamental right that applies regardless of whether the sample agrees to participate, or whether you obtain information in another manner.

Concise and easily understandable information

The information you provide must be concise, easy to understand and written in an easily accessible form. This means that the language must be clear, understandable and tailored to the participant group.

The information must be given in writing, as a general rule. Verbal information is only relevant in certain cases, as you must be able to document the information you give out.

Template for information letter

The privacy regulations contain clear requirements for what the information

Because there are different types of legal bases for processing, we have prepared templates that you can use as a starting point for some of the most common bases in research.

Individual or collective information

As a starting point, you must provide the information individually, for example via letter or e-mail. If it is not possible to inform each individual participant, for example because this would be unreasonably time-consuming, it may be appropriate to provide information collectively.

Examples of collective information are notices in a newspaper or members' magazine, a statement in a comment field, or a notice in a place where you are to observe someone.

When should you provide information?

You must inform the participants before you start collecting personal data about them, as a general rule.

If you are not in direct contact with the people you collect information about, for example during registry studies or when the participants provide information about other persons, you must inform them of this within a reasonable amount of time.

Requirements for the information

If you do not want to use Sikt's template as a starting point, you can prepare your own letter.

At a minimum, the information must include:

  • Introduction with a request to participate in the research project.
  • The purpose of the project and what the information will be used for.
  • Which institution is responsible for processing the information, i.e. the university, university college, hospital trust or research institute at which the research takes place.
  • The methods you will use, what these mean for the participant, and what information is collected.
  • That participation is voluntary and that participants can withdraw as long as the study lasts, without having to give any reason for doing so.
  • The date when the project is scheduled to end, and what will happen to the personal data at that time (whether they are to be deleted, anonymised or kept for further storage).
  • Whether the participants will be able to be identified in a publication or not, and what type of information may be published.
  • The rights of the participants, i.e. the right to access, correct and delete information, in addition to the right to data portability/copy (applicable only in consent-based projects) or object (applicable only in non-consent-based projects).
  • The right to lodge a complaint with the Norwegian Data Protection Authority.
  • Contact details for both the project manager and the institution's data protection officer.

In addition, it may be relevant to provide information about:

  • That the information will be handled confidentially.
  • Who undertakes the contact with the sample/participants, for example if the hospital makes contact on your behalf, or you have received the contact information via a mutual acquaintance.
  • That refusing to participate will not lead to negative consequences. This is particularly relevant if you are going to include patients, pupils or others who have a special relationship with or are dependent on the person who collects the information.
  • The types of sources information is to be collected from, if the information is to be obtained from sources other than the participant themselves, for example from registries or newspapers.
  • If the personal data is to be disclosed to external parties, information must be provided as to what information is to be disclosed, why and to whom. If information is to be transferred outside the EU/EEA, the legal basis for transfer must also be clearly stated.
  • Who is funding the project, if the project receives external funding.

Exemption from the duty to provide information

Much is required before an exception can be made to the duty to provide information. The most common exception is that it will be impossible or disproportionately difficult to provide information.

The following points are relevant for the assessment:

  • The size of the sample (several thousand people).
  • To what extent the sample can be identified.
  • Whether the project group has access to the contact details of the data subjects.
  • The privacy disadvantage, including the number of variables in the collected data and the degree of sensitive information.
  • Ethical considerations.

If you claim an exception from the duty to provide information, it must be well-founded in the notification form for personal data.

Contact with Sikt's Data Protection Services