Notification Form for personal data

Personal data is all information that can be linked to a person, such as a national identity number, name or e-mail address/IP address, and voice on an audio recording.

Sometimes a combined set of information can be linked to a specific person. E.g.: you have exact age, place of residence and field of study, and there is only one 57 year old person from Geilo studying theatre science.

If there is a participant number that links the data to a name, the data is considered personal data, even if the research group does not have access to the list of names.

Read more about what is considered personal data.

When you collect personal data for a research project, you have an obligation to provide information to the people whose personal data you are collecting.

You usually provide information via an information letter. The information you provide here is central to our assessment.

Read more about the requirements for the information you provide.

Processing is any operation performed on personal data, such as:

• collection and registration
• processing and analysis
• transfer and storage
• publishing and archiving

You must notify the project if you will process personal data in connection with the project, even if the data will be anonymised in your thesis or publications.

Read about consent and other legal bases for processing personal data.

1. Think through your research: What methods are you going to use, and what personal data do you need to answer your research questions?
2. Write an information letter for your participants.
3. Create your interview guide or questionnaire, generate the list of variables you will need etc., based on what is relevant for your project.
4. Consider whether you can take measures to reduce the privacy risk for your participants. An important principle is not to collect more personal data than you need, and process data as securely as possible.
5. Familiarise yourself with the guidelines for information security at your institution, e.g. requirements for where personal data should be stored, or which online survey provider you should use.
6. Check whether you need approvals/permits from public bodies before you carry out the project, e.g. from REC (the Regional Committees for Medical and Health Research Ethics), the Directorate of Norwegian Correctional Service, etc.

Based on the information we receive in the Notification Form, one of our advisers will assess the processing of personal data in your project.

The time needed to carry out the assessment will depend on the complexity of the project, and the type of assessment we give.

You will receive a notification by e-mail when the adviser for your project has sent you a message, or when the assessment of your project is ready.

The notification is sent to the email linked to your user. All messages can be found on My Research.

Note that the messages are also visible for your institution, in the Project Archive. If you have questions or comments, send a message to the advisor for your project, or contact us via chat.

If you are asked to make changes, remember to resubmit the reporting form when the changes have been made. The adviser will then review the Notification Form again.

The assessment you receive is documentation that the project will process personal data in a lawful manner.

If you plan changes to the project that affect the processing of personal data, you must notify the changes and get a new assessment.

You notify changes by updating the Notification Form and sending it in gain.

Please send a short summary of the changes in a message to your adviser (in the dialogue linked to the form). Wait for a new assessment before proceeding with the changes.

The person you register as project leader/supervisor is automatically sent an invitation when you send in the Notification Form.

You can also share access with others involved in the project via minforskning.sikt.no.

You can choose the type of access you give, i.e whether the person can read only, edit, or manage (which entails full access, also sharing access with others).

The invitation is sent to the email you provide. The recipient must both click on the invitation link and log in to gain access.

You can easily print or save a PDF of the assessment you receive via My Research (minforskning.sikt.no).

• Go to the Notification Form page (the same place where you read our messages and open the Notification Form).
• Click on "Assessment"
• From "Print", you can choose a "Destination" (print or save to PDF).

You can save a copy of the Notification Form in the same way, by clicking on the "Export" button.

Your institution is required to document all processing of personal data that takes place at the institution. Research institutions use Sikt's Data Protection Services to assist them with this. The notification of the project provides an overview of processing that takes place for research purposes.

In addition:

• Our advisers assess whether the project, as described, meets requirements in data protection legislation. In extreme cases, not notifying the project can lead collected data having to be deleted.
• Data protection legislation provides many opportunities and exemptions for research purposes. We can address potential issues in advance and help you find solutions.
• Completing a Notification Form can help systemise the project and the planned data management.
• Providing well-considered information to participants can make it possible to reuse research data.
• It is easier to get the results published when you can document that the project has processed personal data in compliance with data protection legislation.