How to handle personal or sensitive research data?

What is research data?

Research data are all registered/ noted/ reported as numbers, texts, pictures and sounds generated or appeared during the research project.


Managing research data with personal information (data) or other sensitive information has been describen in the NMBU guidelines for Managing Research Data (laid down 10.04.2018, document in Norwegian).

Your duty to notify

If you will be handling personal information in a research project this has to be reported to NSD. You may check this web page to see if you must send notification about your project. Should the result of the check is that you have to notify to NSD, you can do so with this form.

How NSD assesses the notified projects.

Assessment of privacy consequences (DPIA)

When you send your notification of your project to NSD you may be asked to assess the privacy consequences (DPIA). DPIA sssistance may be requested from Jan Olav Aarflot in the Research Support Office and the NMBU Privacy advisor. Information about DPIA on the Data Protection authorities' web pages.

NMBU Data Protection Officer

Hanne Pernille Gulbrandsen (fra Deliotte) is the NMBU Data Protection Officer. Read more about the NMBU Data Protection Officer (page in Norwegian).

NMBU Privacy advisor

The Data Protection Services (NSD) is the NMBU Privacy advisor for student and employee projectsat NMBU handling research data containing personal information (web page in Norwegian).

The contact person at NMBU for research projects containing personal information is Jan Olav Aarflot in the Research Support Office.

Project Manager responsibility

  • To report the project to NSD. I the report form Jan Olav Aarflot from the Research Support Office must be given as the NMBU contact person.
  • To report any changes arising along the project.
  • To follow up his/ her own project at end of project.

Classifying research data

All research data is classified as green, yellow, red or black. Students and researhcers are liable for complying with the requirements of the different classifications.

  • Open or freely available (Green)
  • Limited (Yellow)
  • Confidential (Red)
  • Strictly confidential (Black)

Read more about classifying research data.

Special categories of personal information

Earlier called "sensitive personal data" is information about:

  • race or ethnic origin (including i.e. citizenship)
  • political standing
  • religious conviction or outlook on life
  • genetic information
  • biometric information
  • health information
  • information about sexual relations or sexual orientation
  • union membership

Date of birth is not seen as sensitive information.

Read more about categories of personal data (sensistive personal data) (Norwegian page)

Nettskjema (survey portal)

NMBU students and researchers have to make use of Nettskjema to collect research data with sensitive personal data or research data in particular categories Nettskjema may be used as a questionnaire, regitrations and multiple choice tasks, and may handle large quantities of data, and data from mobile apps. Read more about Nettskjema here.

Storage of research data with personal information

Research data affected by the Health Research Act, Biotechnology Law, the Filing Sytems Act, the Personal Data Act (GDPR), reputed as sensitive data and requires specific handling. The Law requires all such data to be managed and stored in a secure and secure manner.

  • Research data with personal information are normally classified as yellow. Such data may be stored at the NMBU w: server. In this case the data have to be anonymised. A scrambling key must be stored separately from the data, and may i.e. be stored at TSD. Read more about how to anonymise data material
  • Researhc data with particular categories (earlier called sensistive personal information) and health information will normally be classified as red.
  • Large quantities of sensitive personal information or health information are normally classified as black.
  • Red and black research data must be stored at the Services for sensitive data (TSD). TSD allows the researchers access to a research platform that fulfills the strict regulations of handling and storing sensitive research data (incl. personal data). NMBU students and researchers may make use of this service. TSD is operated by USIT at UiO.
  • Research data with personal information or other sensitive information MUST NOT be stored on a laptop/ C drive, phone, dropbox, external hard drive or similar.

Read more about how to anonymise data material.

Archiving research data with personal information

Archiving personal data or research data with sensitive information is not always possible. However, NSD has a data archive for archiving research data with personal information. 

National information about privacy act

(in Norwegian only)

Ressursnettside for personvern (

Personvern (e-læring 3-5 min) (

Published 23. May 2018 - 8:56 - Updated 28. April 2021 - 11:14