Template agreements for the management of personal data
Please contact us for information on personal data/GDPR, data management or general research ethics!
Legal Adviser
IT-director
Director of Research
We have three different agreements relevant to the protection of personal data. Here we have collected information on when to use the various templates, and links to actual templates that you can fill in yourself.
Joint processing responsibility for personal data
Templates for joint processing responsibility agreements
When must I enter into an agreement on joint processing responsibility for personal data?
In research
When you, as a researcher at MF, are to collaborate with researchers at another institution on a data set where you process personal data, you must enter into an agreement on joint processing responsibility. This may also be relevant if you supervise students at another institution and must have access to the data material. The agreement must be signed by a manager on behalf of the institution (at MF: Pro-Rector).
Please note:
The project leader (in master's theses the supervisor) is responsible for personal data being processed in accordance with the legislation, but it is MF as an institution that has the overall responsibility for processing personal data.
In administrative operations
When MF uses external suppliers to process personal data on behalf of the institution, an agreement must be entered into between MF and the other business/institution.
An agreement must also be signed if MF collaborates with another business on the collection or other processing of personal data.
The agreement must be signed by an administrative manager.
Data management agreement, non-disclosure agreement
When should I enter into a data management agreement in a research project?
If you outsource parts of the data processing to a business/institution/natural person outside MF, a data management agreement must be entered into.
In privacy legislation, 'processing' is understood very broadly. It includes collection, registration, organisation, structuring, storage, adaptation or change, retrieval, consultation, use, etc.
The data management agreement is an important legal document that must be in place as early as possible, and before the processing of personal data begins.
Examples of cases where a data management agreement must be in place:
- Translation of material with personal data
- Transcribing interviews
- handling audio or image files with personal data
This means that project staff such as interpreters, transcription assistants and research assistants are considered data processors if they are external to MF. They must therefore sign a data management agreement on how the personal data is to be processed - in addition to a non-disclosure agreement.
External or internal person?
'External' refers to all persons that MF has no instructional authority over.
Persons MF has instructional authority over and who are considered to be internal:
- people who are considered students at MF and who sign a non-disclosure agreement.
- employees who have an employment agreement and sign a non-disclosure agreement (also applies to persons linked to MF via short term contracts etc.)
Download templates:
Responsibility and signature
As a project leader/PI it is your responsibility that these agreements come about, but the research administration and legal advisor will be happy to help you.
The agreement must be signed by a manager on behalf of the institution (at MF: pro-rector).
Agreement on data transfer abroad (controller to controller)
Agreement template
When transferring personal data abroad, you must ensure that the rules are adhered to. Transfers to countries outside the EU and the EEA area ("third country") require a legal basis, in addition to a cooperation agreement, possibly a data magnagement agreement, etc.
Feel free to contact legal adviser Berit Widerøe Hillestad to secure the details of such an agreement.
The templates have been designed in consultation with the research administration at OsloMet and NTNU, and are based on these institutions' templates.