Notification Form for personal data

Personal data is all information that can be linked to a person, such as a national identity number, name or e-mail address/IP address, and voice on an audio recording.

Sometimes a combined set of information can be linked to a specific person. E.g.: you have exact age, place of residence and field of study, and there is only one 57 year old person from Geilo studying theatre science at the university.

If there is a participant number that links the data to a name, the data is considered personal data, even if the research team does not have access to the list of names.

Read more about what is considered personal data.

When you collect personal data for a research project, you have an obligation to provide information to the people whose personal data you are collecting.

You usually provide information via an information letter. The information you provide here is central to our assessment.

If you are not in contact with the people whose personal data you are using, and it will be difficult to provide information, you must explain this in your Notification Form.

Read more about the requirements for the information you provide.

Processing is anything you “do” with personal data, such as:

• collection and registration
• downloading and sharing
• processing and analysis
• transfer and storage
• publishing and archiving

You must notify the project if you will process personal data in connection with the project, even if the data will be anonymised in your thesis or publications.

Read about legal bases for processing personal data.

1. Think through your research: What methods are you going to use, and what personal data do you need to answer your research questions?
2. Write an information letter for the people whose personal data you will be processing.
3. Create your interview guide or questionnaire, generate the list of variables you will need etc., based on what is relevant for your project.
4. Consider whether you can take measures to reduce the privacy risk for your participants. An important principle is not to collect more personal data than you need, and process data as securely as possible.
5. Familiarise yourself with the guidelines for information security at your institution, e.g. requirements for where personal data should be stored, or which online survey provider you should use.
6. Check whether you need approvals/permits from public bodies before you carry out the project, e.g. from REC (the Regional Committees for Medical and Health Research Ethics), the Directorate of Norwegian Correctional Service, etc.

Based on the information we receive in the Notification Form, one of our advisers will assess the processing of personal data in your project. If we have any comments or questions, we will send you a message in the dialogue linked to your form.

The time needed to carry out the assessment will depend on the complexity of the project, and the type of assessment we give.

You will receive a notification by e-mail when the adviser for your project has sent you a message, or when the assessment of your project is ready.

The notification is sent to the email linked to your user. All messages can be found on My Research. Note that the messages are also visible for your institution, in the Project Archive.

If you have questions or comments, send a message to the advisor for your project in the dialogue linked to you Notification Form, or contact us via chat.

If you are asked to make changes, remember to resubmit the Notification Form when the changes have been made. An adviser will then review the Notification Form again.

The assessment you receive is documentation that the project will process personal data in accordance with data protection legislation.

If you plan changes to the project that affect the processing of personal data, you must notify the changes and get a new assessment.

You notify changes by updating the Notification Form and sending it in again.

Please send a short summary of the changes in a message to your adviser (in the dialogue linked to the form). Wait for a new assessment before proceeding with the changes.

The person you register as project leader (supervisor) is automatically sent an invitation when you send in the Notification Form.

You can also share access with others involved in the project via minforskning.sikt.no.

You can choose the type of access you give, i.e whether the person can read only, can edit, or also manage (which entails full access, also sharing access with others).

The invitation is sent to the email you provide. The recipient must both click on the invitation link and log in to gain access.

You can easily print or save a PDF of the assessment you receive via My Research (minforskning.sikt.no).

• Go to the Notification Form page (the same place where you read our messages and open the Notification Form).
• Click on "Assessment"
• From "Print", you can choose a "Destination" (print or save to PDF).

You can save a copy of the Notification Form in the same way, by clicking on the "Export" button.

Your institution is required to document all processing of personal data that takes place at the institution. Research institutions use Sikt's Data Protection Services to assist them with this. The notification of the project provides an overview of processing that takes place for research purposes.

In addition:

• Our advisers assess whether the project, as described, meets requirements in data protection legislation. In extreme cases, not notifying the project can lead to collected data having to be deleted.
• Data protection legislation provides many opportunities and exemptions for research purposes. We can address potential issues in advance and help you find solutions.
• Completing a Notification Form can help systemise the project and the planned data management.
• Providing well-considered information to participants can make it possible to reuse research data.
• It is easier to get the results published when you can document that the project has processed personal data in compliance with data protection legislation.