Types of assessments of the notification form
When you have submitted a notification form for personal data, you can receive different assessments from us, depending on the privacy disadvantage and the risk in the project.
Based on the information researchers and students fill out in Sikt's notification form for personal data in research, they will receive one of the following types of assessment from us:
Standard assessment
The notification form is reviewed by an adviser who gives an assessment, usually within 30 days.
In the case of a standard assessment, an adviser reviews the information letter and other attachments.
f the processing of the personal data has a high disadvantage and risk for the privacy, there may be a need for a Data Protection Impact Assessment (DPIA).
Automatic assessment
The notification form is assessed automatically, without an adviser reviewing the registration form. This only applies to the projects where the prosessing of personal data has a low privacy disadvantage and risk.
These project will receive an assessment on the same day that the registration form is submitted.
Attachments to the registration form are also not reviewed manually by an adviser. The student/researcher must ensure that the information letter contains legally required information. This can e.g. is done by using our templates for information letters.
You can read more about automatic assessment further down this page.
Joint assessment of student projects
If you have several student projects with the same theme, short duration and low privacy disadvantage, these can be notified together. Sikt will then assess these projects in a joint assessment.
Joint assessment is mainly relevant for annual studies and bachelor's projects.
To do a joint registration, the subject or subject manager must take on the responsibility as project manager.
Special information concerning automatic assessment
Automatic assessment is only given to institutions that have an agreement to that effect.
We have tested automatic assessment for a long period prior to implementing the functionality in November 2022.
Monitoring of the system
Since automatic assessment is a relatively new functionality that is still under development, we monitor the system and take numerous random samples.
If we see errors or omissions in the notification form, and discover that the project has a higher risk than what is registered, we will withdraw the assessment and give a standard assessment.
Screening of projects for automatic assessment
Several criteria and checks in the notification form are involved in computing a low privacy disadvantage and risk score.
The criteria are detailed, but the most important are:
- The project does not process special categories of personal data
- The duration is limited in time
- The number of data subjects is low
- All of the data subjects receive individual information
- The data subjects are over 15 years of age
Incorrect information in the notification form
The most common errors we find when we take random samples are:
- The project processes special categories of personal data (sensitive information), but has not ticked for it in the notification form.
- Somewhat incomplete information in the information letters, e.g. that the contact information for the institution's data protection officer is not included.
- Failure to register third parties (persons that participants talk about).
Contact Sikt's Data Protection Services
Message: Log in to minforskning.sikt.no and contact your adviser by sending a message.
Chat: Open weekdays from 12 to 14. Closed on Wednesdays.
Phone: +47 73 98 40 40 weekdays from 10-12. Closed on Wednesdays.
Information to the participants
When you collect information about people, you have a duty to notify them. See the requirements, and use our templates for the information letter.
Notify changes in the project
Sometimes you will need to make changes to the project after the notification form has been completed and assessed. See which changes you must notify Sikt of.
Guide to processing personal data in research
Get an overview of our information and guidance to the Personal Data Act. Some pages is in English, some will be in Norwegian.