Objective for Processing Personal Data
Personal data are used for payroll and personnel administration, such as calculating salary, keeping track of working hours, absences, holidays, and leaves of absence. We also use the information to assess and evaluate applicants for advertised positions.
Legal Basis for Processing Personal Data
The legal basis for processing personal data about employees is GDPR Article 6(1)(a), (b), (c) (cf. Article 6(3)(b), cf. the Working Environment Act §13‑4) or (f), as well as Article 9(2)(a) or (b) (cf. the Working Environment Act §9‑3).
For employees:
The legal basis for processing personal data related to creating a user account, including the use of national identity numbers for secure identification under the Personal Data Act §12, is GDPR Article 6(1)(b), meaning your employment contract with NIH.
The legal basis for logging your activity as a user of our systems is GDPR Article 6(1)(c), legal obligation, cf. Article 6(3)(b), cf. GDPR Article 32.
For job applicants:
The legal basis for processing personal data in applications is GDPR Article 6(1)(b), as it is necessary to take steps at the request of the job applicant prior to entering into an employment contract.
Data Controller
NIH is the data controller for personal data collected and processed at NIH, cf. GDPR Article 4(7).
The Managing Director holds overall responsibility. Day‑to‑day responsibility is delegated to line managers. For employees and job applicants, this is the HR Director.
Which Personal Data We Collect and Process
We register the following personal data about you as an employee:
- First name, middle name, last name
- National identity number
- Home address
- Telephone number
- Email address
- Position category
- Salary
- Trade union affiliation
- Education and seniority
- Secondary positions
Information about working hours, time off in lieu, holidays, other absences, and leave of absence
User information is collected directly from you and from your employment contract with NIH.
NIH uses DFØ’s self‑service solution, where employees may register information about children and next of kin. To receive quota for sick child leave, you must provide the child’s date of birth. Providing the child’s name is voluntary. Providing contact information for next of kin is also voluntary.
Through SAP, information is retrieved from NAV and the Norwegian Tax Administration, such as tax cards and any sick leave certificates, parental benefit applications, or other employment‑related information submitted to NAV.
For hourly‑paid employees, personal data are retrieved from the ToA solution, a service delivered by DFØ.
For job applicants, NIH uses the information the applicant has registered.
Processing of Personal Data for Employees and Job Applicants
When you are employed at NIH, information about you is registered in SAP. SAP is the source system for employees and affiliates. A user account is created automatically based on data in SAP, according to defined business roles.
After the user account is created, all activity linked to your user account will be logged.
Information about your name, position, and work area is considered public information and may be published on our website. Your portrait photo may also be published unless you request that it not be.
For job applicants, NIH evaluates submitted documents such as CVs, diplomas, and certificates. We may also contact references in connection with entering into an employment contract. NIH uses Jobbnorge to manage applications for vacant positions.
Security Related to the Processing of Your Personal Data
Personal data about employees are mainly processed in NIH’s payroll and personnel systems SAP and UNIT4 ERP, and in the archive system P360.
SAP is an access‑controlled system. Only case handlers with a service‑related need may access the system. All access in the archive system P360 is controlled through access groups, limiting who may view information based on service needs.
Only designated IT security personnel perform checks of your user activity.
Job applications are stored in Jobbnorge’s application system.
Disclosure of Your Personal Data
Requests for disclosure of personal data are access requests that must be assessed under the Freedom of Information Act. The main rule is openness, and refusals require a specific legal basis. This applies, for example, to information requested by (non‑exhaustive list):
- NAV, which has the right to obtain information for control purposes under the National Insurance Act §21‑4
- The Norwegian State Educational Loan Fund, under its own legislation
- Tax authorities, under their own legislation
- Next of kin, who may have the right to information to make decisions on behalf of a relative who cannot make decisions themselves
- The Research Integrity Committee, for cases involving scientific misconduct
- Job applications, which may be disclosed upon request
Storage Period for Personal Data
Personal data registered in SAP are subject to the financial regulations and are not deleted.
Logging of your user activity is normally deleted within six months but may be retained longer if required.
In Jobbnorge, applications are deleted 365 days after a recruitment process has ended. For applicants who were hired or interviewed, applications are deleted after 540 days.
Your Rights
See more about your rights to access, correction, and deletion at:
https://www.nih.no/om/personvern/erklaeringer/dine-rettigheter.html
Contact
Contact the HR Department
If you have questions about the processing of your personal data as an employee or job applicant, contact the HR Department via the HR Director.
Data Protection Officer
The Data Protection Officer safeguards the privacy interests of students, employees, and job applicants. Since April 2024, NIH has used Sikt’s Data Protection Officer service.
Email: personvernombud@nih.no