Skip to Content

Research

Research

Data protection in research

Before you as project manager initiate a research project, you must know if the data are anonymised and what external bodies' approval is required for the use of different types of personal data.

Normally, research projects need the approval of the Regional Committees for Medical and Health Research Ethics (REC), the Norwegian Centre for Research Data (NSD) or the Norwegian Data Protection Authority.

Are the data anonymised?

The first question it is important to ask is whether you are going to use anonymised data or not. Anonymised data are information that cannot be used to identify individuals in the data material, neither directly through names, personal ID numbers or other unique characteristics or indirectly via background variables, nor through a list of names / connection key or encryption formula or code. You must be aware of the fact that the information in itself may be enough to identify the individual participant. The personal data will in such case not be deemed to be adequately anonymised.

You must also note that a compilation of various databases can de-anonymise personal data in such a way that the research participants can be identified.

If the data is totally anonymised, you do not have to apply to an external body.

Nettskjema (uio.no) can be used if you like the survey to be anonymious. Check website for action to ensure anonymity (in Norwegian only) and website about electronic track (in Norwegian only).

You can read about how you can conduct projects without registering personal data on NSD's website.

Informasjon and brochure on NSD`s website (in Norwegian only).

Cases of doubt

There can be cases of doubt in which it is uncertain whether research data has been adequately anonymised or not, e.g. in the case of small samples, in, for example, research on a diagnosis that few people in Norway have or a research project with few research participants within a limited geographical area. In cases of doubt you should check with the data protection official (NSD). NSD also has an informal obligation to notify test that you can try.

What is the approval body for your research project?

The objective determines where you must apply for approval 

If you are going to use data that have not been adequately anonymised in your research project, you must consider what external bodies you must apply for approval from. The objective of the research and the type of data to be used in the research project is decisive for your choice.

Objective 1 - You must apply for approval from NSD when:

Research with an objective other than to generate new knowledge about illness and health can be covered by both the Personal Data Act and the Personal Health Data Filing System Act.

  • Social science objectives.
  • Quality assurance, defined as projects, surveys, evaluations etc. whose objective is to ensure that diagnostics and treatment actually produce the intended results.
  • The establishment of health registers, defined as registers, lists etc. in which health data is stored systematically (listed) so that information about individuals can be retrieved, cf. Section 2 (6) of the Personal Health Data Filing System Act. Health registers can be paper-based or electronic. For example, registers such as records systems in the health service can be used or created for research purposes, see Section 2 (2) of the Health Research Act.
  • The collection of health data with an objective other than to generate new knowledge about health and illness, see Section 2 (1) and 4 d) of the Health Research Act.
  • See Examples of activities that do not require approval from REC on REC's website.

More information how to notify NSD.

List of definitions of the terms in the table.

Approval authority
Type of project Approval authority Legislation Advisory body
Non-sensitive personal data – manual processing Not subject to approval      
Non-sensitive personal data (under 5,000 objects) – electronic processing   NSD Pol. §§ 2 nr. 1 and  31 (1) a) and Pol. Regulations § 7-27 (1) NSD
Non-sensitive personal data (over 5,000 objects and long duration) – electronic processing   The Norwegian Data Protection Authority   Pol. §§ 2.nr. 1 and 31 (1) a) and Pol. Regulations § 7-27 (2) NSD
Sensitive personal data – manual systematisation, by name/date of birth   NSD Pol. §§ 2 nr. 8 and 31 (1) b) NSD
Sensitive personal data (under 5,000 objects) – electronic processing   NSD Pol. §§ 2 nr. 8 an 33 and Pol. Regulations  § 7-27 (1) NSD
Sensitive personal data (over 5,000 objects and long duration) – electronic processing   The Norwegian Data Protection Authority   Pol. §§ 2.nr. 8 and 33 and Pol. Regulations § 7-27 (2) NSD

Objective 2 - You Du skal apply for approval from REC when:

  • 'Activity conducted using scientific methods to generate new knowledge about health and illness', see Section 4 a) of the Health Research Act.
  • Establishment of health registers as part of a concrete medical and health-related research project.
  • Se Examples of activities that require approval from REC on REC's website.

More information how to apply to REC.

Approval authority
Type of project Approval authority Legislation Advisory body
Medical and health research   REC The Health Research Act § 2 (1)   REC
Research on human subjects   REC The Health Research Act § 2 (1)   REC
Natural health remedies or other substances consumed by people   REC, State Medicine Agency The Health Research Act § 2 (3) and the Medicines Act § 3 with Regulations   State Medicines Agency
Research in which medical equipment is used on people   REC, Directorate of Health The Health Research Act § 2 (3)and the Medical equipment Act with Regulations   Directorate of Health
Research on human biological material   REC The Health Research Act § 2 (1) and 4 b)   REC
Research that entails collecting health data   REC The Health Research Act § 2 (1) and 4 d),
and the Healthcare Act § 21  
REC

Read more about data protection

Routine

Procedures for notification to NSD is located on web group for research advisors at faculty/center.

Contact