How to handle and process personal or sensitive research data?

What is research data?

Research data are all registered/ noted/ reported as numbers, texts, pictures and sounds generated or appeared during the research project.

Guidelines

Handling research data with personal information (data) or other sensitive information has been describen in the NMBU guidelines for Handling Research Data (laid down 10.04.2018, document in Norwegian).

Your duty to notify

If you will be handling personal information in a research project this has to be reported to NSD. You may check this web page to see if you must send notification about your project. Should the result of the check is that you have to notify to NSD, you can do so with this form.

How NSD assesses the notified projects.

Assessment of privacy consequences (DPIA)

When you send your notification of your project to NSD you may be asked to assess the privacy consequences (DPIA). DPIA sssistance may be requested from Jan Olav Aarflot in the Research Support Office and the NMBU Privacy advisor. Information about DPIA on the Data Protection authorities' web pages.

NMBU Data Protection Officer

Hanne Pernille Gulbrandsen (fra Deliotte) is the NMBU Data Protection Officer. Read more about the NMBU Data Protection Officer (page in Norwegian).

NMBU Privacy advisor

The Data Protection Services (NSD) is the NMBU Privacy advisor for student and employee projects at NMBU handling research data containing personal information.

The contact person at NMBU for research projects containing personal information is Jan Olav Aarflot in the Research Support Office.

Project Manager responsibility

  • To report the project to NSD. I the report form Jan Olav Aarflot from the Research Support Office must be given as the NMBU contact person.
  • To report any changes arising along the project.
  • To follow up his/ her own project at end of project.

Classifying research data

All research data is classified as green, yellow, red or black. Students and researhcers are liable for complying with the requirements of the different classifications.

  • Open or freely available (GREEN) - Research data not containing personal information, for example data about animals, plants, bacteria etc.
  • Limited (YELLOW) - De-identified data where the key is locked away and stored safely away from the data, anonymized data, data sets containing minor amounts of non-sensitive personal data.
  • Confidential (RED) - Research data with sensitive personal information or information about health.
  • Strictly confidential (BLACK) - Large amounts of sensitive personal information, large amounts of health information, research data or data sets of great economic value.

Read more about classification of research data here.

Read more about how to anonymise data material here.

Special categories of personal information

Earlier called "sensitive personal data" is information about:

  • race or ethnic origin (including i.e. citizenship)
  • political standing
  • religious conviction or outlook on life
  • genetic information
  • biometric information
  • health information
  • information about sexual relations or sexual orientation
  • union membership

Date of birth is not seen as sensitive information.

Read more about categories of personal data here (Norwegian web page).

Nettskjema (survey portal)

NMBU students and researchers have to make use of Nettskjema to collect research data with sensitive personal data or research data in particular categories Nettskjema may be used as a questionnaire, regitrations and multiple choice tasks, and may handle large quantities of data, and data from mobile apps. Read more about Nettskjema here.

Storage of personal data

Research data affected by the Health Research Act, Biotechnology Law, the Filing Sytems Act, the Personal Data Act (GDPR), reputed as sensitive data and requires specific handling. 

  • Research data classified as YELLOW may be stored using the LargeFile server W:.
  • Research data classified as RED and BLACK should be stored using the Tjenester for sensitive data (TSD), a platform fulfills the strict regulations of handling such data. TSD is operated by UiO.
  • Research data classified as RED and BLACK MUST NOT be stored on a laptop/ C: drive, iPad, cell phone, dropbox, external hard drive or similar.

Archiving personal data

Archiving personal data is normally not possible. However, anonymized data og de-identified data may be archieved.

National information about privacy act

(web pages in Norwegian only)

Ressursnettside for personvern (sikresiden.no)

Personvern (e-læring 3-5 min) (sikresiden.no)

Published 23. May 2018 - 8:56 - Updated 11. October 2021 - 12:24