Assessment of submitted notification forms 

If our data protection advisers have questions or comments, they will use the message dialogue linked to the Notification Form to submit them.

The assessment time depends on the complexity of the project. Our aim is to make an assessment within 30 days.

What do we assess?

Our goal is to help you ensure sound data protection and carry out your project. Among other things, we check:

• Whether the personal data you will collect is relevant to the purpose of the research project.
• How you have planned to collect, record, store and, if applicable, collate or disclose personal data.
• That the information given to the participants meets the legal requirements and describes the project in an understandable manner.
• That the information given to the participants matches what is given in the notification form.
• Whether the project can/should be exempted from some of the rights described in the data protection legislation, and how any arguments for exceptions should proceed.
• Whether you must obtain consent, or whether the data can be lawfully processed in another manner.
• Whether the data protection principles have been safeguarded (legality, fairness and transparency, purpose limitation, data minimisation and storage limitation).

What happens when the notification form is submitted?

If the adviser has questions or comments about the project or the registration, the notification form will be sent back to you with our comments.

There may be tick boxes in the form that need to be changed, that we need more information to be able to make an assessment, or that you need to better justify aspects of the project.

Based on the information you provide, the project will recieve one of the following types of assessment:

• Standard assessment
• Automatic assessment
• Joint assessment for student projects

Returned notification forms

If the notification form has been returned to you, you will find the adviser's comments on My Page. You must then make the necessary changes and resubmit the form.

You must justify the processing activities yourself

Sikt's advisers can offer tips and guidance, but cannot change or update your notification form. You must fill in the notification form yourself and argue for what is right in your project.

When the notification form has been assessed, this serves as documentation that your project processes personal data in a lawful manner.

Remember that you must follow up the project at the end of the project, and if changes take place during the course of the project.

Assessment time

When you have submitted the notification form, an adviser will carry out an initial review and provide feedback within 30 days from the date of submission.

The assessment period will often be shorter, but this depends on several things, including:

• That you have provided complete information about the project and submitted the necessary documentation.
• That you correct and make changes in the event of comments from Sikt's adviser.
• The complexity of the project and the scope of personal data.
• Intake of submitted notification forms. The intake period is typically the busiest (and the queue is the longest) from November to February.

Dialogue about the notification form

You will receive an e-mail that a new message is waiting when:

• We have asked questions in the message dialogue.
• If you have received the notification form in return.
• The assessment of your project has been completed.

All message dialogue between you and Sikt's data protection services is saved and visible on My Page.