Responsibility for Data Protection in the Administration
The Director General is responsible for NIH’s administrative processing of personal data. This includes ensuring that NIH has established guidelines for data security and privacy, as well as responsibility for implementing IT solutions for the secure handling of personal data.
The practical follow-up of this responsibility is delegated to department heads and institute/section managers.
Responsibility Data Protection - Administrative Managers
Administrative managers includes department heads, centre directors, and administrative unit managers.
Administrative managers are responsible for ensuring that personal data is processed appropriately within their area. This includes:
- Establishing and maintaining adequate procedures and guidelines for processing personal data
- Ensuring that all processing has a valid legal basis
- Registering and maintaining up-to-date records of processing activities LENKE
- Ensuring that staff receive sufficient training and guidance on data protection practices
- Contributing to internal control processes and annual reviews
For department heads, additional responsibilities related to research projects may apply. See Privacy in Research - Routines and also Privacy Resources NIH
Responsibility Data Protection - Case Handlers
Case handlers includes staff in HR, administration, student services, IT, communication, finance, and facilities.
Case handlers must:
- Ensure high data quality (data must be relevant, accurate, and up to date)
- Assess and document the legal basis for processing personal data
- Follow established procedures, guidelines, and institutional rules
- Be familiar with data classification and storage requirements
- Report any need for training or clarification to their manager
About Personal Data
Personal data is any information that can be used to identify a natural person. Identification may be direct or indirect. The individual owns their own personal data.
Information and assessments are considered personal data regardless of format, including text, images, audio recordings, or video recordings.
Special Categories of Personal Data
Certain types of personal data require additional protection. In the regulations, these are referred to as special categories of personal data, often also called sensitive personal data.
See more information on the Norwegian Data Protection Authority (DPA) Datatilsynets homepages (mainly in Norwegian), and also on the European Commissions homepage regarding information for individuals
Use of National Identity Numbers
National identity numbers are not classified as special categories of personal data, but their use is subject to strict conditions.
They may only be used when:
- Secure identification is necessary
- Identification cannot reasonably be achieved by other means (e.g. employee or student ID numbers)
Requests for Address Lists
As a general rule, lists of student names and contact details are not shared with external parties.
If sharing is considered:
- The purpose must align with institutional goals
- Privacy implications must be carefully assessed
- Any disclosure must be documented in the processing register
Reporting Data Protection and Security Incidents
All suspected breaches must be reported immediately. Send notification to sikkerhetsavvik@nih.no. Inform your immediate manager where possible
Examples of reportable incidents include:
- Personal data sent to unauthorized recipients
- Compromised passwords due to phishing
- Incorrect classification or storage of sensitive information
Serious incidents must be reported by the institution to the Data Protection Authority within 72 hours.
General Data Protection Guidelines
Protect Personal Privacy
- Do not leave printouts unattended—use secure printing and locked storage
- Avoid sending sensitive personal data via email; use secure systems
- Use internal identifiers instead of national ID numbers where possible
- Do not store sensitive data on unsecured devices
- Never share your user account or password
- Always lock your computer when leaving your workstation
Limit Storage and Printing
- Limit Storage and Printing
- Only store or print personal data when necessary
- Avoid retaining information longer than needed
- Delete Data When No Longer Needed
- Delete or securely dispose of personal data once the purpose is fulfilled
- Establish regular routines for data clean-up
Be Aware of Your Responsibility
- Handle personal data with care and professionalism
- Be a role model for good data protection practices
- Help build a culture of awareness and responsibility