Privacy Statement

This privacy statement describes how NOKUT processes personal data. NOKUT is committed to ensuring the privacy, confidentiality and availability of personal information.

  • All processing of personal data in NOKUT shall comply with the applicable privacy regulations, including the Personal Data Act and the EU General Data Protection Regulation (GDPR). We have established appropriate security measures to protect the confidentiality, availability, and integrity of your personal data. All employees are subject to confidentiality.

    NOKUT uses suppliers who may process personal data on our behalf (data processors). We ensure to enter into data processing agreements with the suppliers that allow us to monitor that the suppliers process personal data in accordance with the requirements of the privacy regulations. NOKUT uses Advania Norway AS as a supplier of IT services, Tietoevry Norway AS as a supplier of archive systems, DFØ as a supplier of accounting services, and Rambøll as a supplier of surveys. A complete list of data processors can be provided upon request.

    As a general rule, we do not transfer personal data to countries outside the EU/EEA (third countries). However, in exceptional cases, personal data may be transferred by data processors located in third countries gaining access to personal data stored in the EU/EEA. In such transfers, NOKUT will ensure that there is a legal basis for the transfer and that the personal data is subject to an adequate level of protection.

  • NOKUT is the data controller for the processing of personal data where NOKUT determines the purpose of the processing. NOKUT can be contacted via:

    Email: postmottak@nokut.no
    Address: Postboks 578, 1327 Lysaker
    Telephone: +47 21 02 18 00

    The NOKUT data protection officer

    NOKUT has its own Data Protection Officer. You can contact the Data Protection Officer with questions about your rights and the processing of your personal data. The Data Protection Officer can be contacted via:

    Email: personvernombud@nokut.no

    Please note that regular email may be unencrypted. We encourage everyone who wishes to send us sensitive personal data via email, such as personal identification numbers, to use encryption.

  • Anyone who has personal data registered about themselves in NOKUT's systems has the right to:

    • Access the personal data
    • Rectify incorrect and incomplete personal data
    • Delete personal data
    • Restrict the processing of personal data
    • Data portability
    • Object to the processing of personal data

    If the processing of personal data is based on your consent, you can withdraw your consent at any time. However, this does not affect the legality of the processing before the consent is withdrawn.

    The legislation allows us, in some cases, to make exceptions to the right to deletion. For example, this will be the case when we need to store the personal data to fulfill a task we are required to do by law, or to safeguard important societal interests such as archiving, research, and statistics.

    We process requests for access, rectification, and deletion without undue delay and normally within 30 days.

    If you believe that we are processing personal data in violation of the privacy regulations, you can file a complaint with NOKUT's Data Protection Officer. You also have the option to complain to the Norwegian Data Protection Authority.

  • 4.1 Web Statistics, Web Analysis, and Cookies

    NOKUT monitors the usage patterns of those who visit nokut.no to create a user-friendly website. To analyze the information from the website, we use the analysis tool Matomo.

    Matomo collects and then anonymizes the IP address before the service stores and processes the information. Thus, the stored IP address cannot be used to identify individual users.

    Cookies are optional and will only be stored on your device if you consent to it. The legal basis for this processing is your consent (GDPR Article 6(1)(a)). You can block and allow cookies through your browser settings. Read more about how to do this on Nettvett.no.

    4.2 Newsletters

    You can subscribe to electronic newsletters from NOKUT. The legal basis for this processing is your consent, cf. GDPR Article 6(1)(a). To send emails to the correct recipient, we need to store your email address. When you unsubscribe, your email address will be deleted.

  • When NOKUT hosts events, we use the electronic registration form on our website. If you register for an event, you consent to us storing personal data about you for use in the specific event. We need this information to know which participants are registered and to send out a questionnaire for event evaluation.

    You can consent to us retaining your personal data (name, email, and information about which events you participated in) so that we can invite you to other relevant events in the future. If you do not consent to this, we will delete your information after the event is completed.

    Information processed in connection with direct billing to participants follows accounting legislation, and we are required to keep it in the accounting system for 10 years. In this context, your name and address are processed.

    NOKUT occasionally takes portrait or situational photos at events and publishes them on the internet, in written reports, or articles. NOKUT's legal basis for this will be GDPR Article 6(1)(a), i.e., your explicit consent, or Article 9(2)(a).

    For meetings and events, NOKUT invites participants to inform us about foods they do not eat (dietary preferences). Information about allergies is a special category of personal data. In most cases, it is not necessary to state that a dietary preference is due to an allergy. NOKUT's legal basis for processing information about dietary preferences, or allergies, will be your explicit consent, cf. Article 9(2)(a). You can withdraw this consent at any time. Withdrawing your consent will not affect the legality of the processing that occurred while your consent was valid.

  • 6.1 General

    If you apply for a job at NOKUT, we process personal data about you to evaluate your application. The personal data may include your name, address, email address, phone number, profile picture, CV, reference conversations, diplomas, and certificates. The legal basis for processing your personal data is your consent, cf. GDPR Article 6(1)(a).

    NOKUT uses the recruitment tool Jobbnorge. The tool is provided by Grade Jobbnorge AS, which is thus the data processor for NOKUT. Job applications are deleted in Jobbnorge after one year. Any diplomas, certificates, and other attachments you, as a job seeker, have uploaded to Jobbnorge are also deleted.

    If you, as a job seeker, state that you have a disability that will require accommodation in the workplace or in the employment relationship, have an immigrant background, or have been absent from work, education, or training for at least two of the last five years, NOKUT is obliged to call in at least one applicant who is qualified for the position with such a disability or background for an interview, cf. Regulation to the Act on State Employees § 4.

    You are not required to provide sensitive personal data in your application, but if you choose to do so, the legal basis for processing will be GDPR Article 9(2)(b), cf. Regulation to the State Employee Act § 4. The processing is necessary for NOKUT to fulfill its labor law obligations, and for you as a job seeker to secure your rights.

    In the recruitment process, NOKUT will process personal data that is necessary to fulfill our legal obligations (GDPR Article 6(1)(c)) under the State Employee Act (only in Norwegian), the Public Administration Act, the Freedom of Information Act, and the Archives Act (only in Norwegian). NOKUT will also, in some cases, process personal data to pursue a legitimate interest (GDPR Article 6(1)(f)). The legitimate interest is to hire the right person for the advertised position.

    6.2 Interviews and References

    In connection with conducting interviews, NOKUT may also prepare internal notes in Jobbnorge. NOKUT will only note information that is considered relevant for assessing whether the applicant is suitable for the position. The notes are deleted from Jobbnorge after 12 months.
    In addition to any interview, we may also conduct our own investigations, typically by obtaining references from the reference persons you provide. We then use the reference tool Refapp. The personal data stored are assessments and information about your current or previous employment. The information is automatically deleted after 12 months.

    For management positions, NOKUT uses an external recruitment agency. You may then be asked to complete personality and/or aptitude tests. Processing the results requires consent, cf. GDPR Article 6(1)(a), which you can later withdraw. The tests are not shared with NOKUT and are managed entirely by the external recruitment agency.

    6.3 Applicant Lists

    NOKUT is obliged under the Freedom of Information Act § 25 to provide access to applicant lists. The applicant list will contain the name, age, position or job title, and place of residence and work municipality for each job seeker. Exceptions to access may be made for information about you as a job seeker if you request it. In assessing whether such a request should be granted, emphasis should be placed on whether there is particular public interest in the position. Exceptions to access may be made for documents in cases of appointment or promotion in public service. The purpose in this case will be to provide the public with insight into public appointments. The legal basis for processing will be GDPR Article 6(1)(c) (legal obligation), cf. Freedom of Information Act § 25.

    NOKUT is obliged to preserve applicant lists in accordance with archival legislation.

  • NOKUT regularly conducts surveys. The purpose of the surveys is usually to map opinions on various educations to identify areas for improvement. NOKUT may obtain names and email addresses from the Common Student System (FS) or educational institutions. The legal basis for processing these personal data is GDPR Article 6(1)(e) – the processing is necessary to perform a task in the public interest that NOKUT is required to do according to the Universities and Colleges Act.

    NOKUT may also send out questionnaires to evaluate its own processes and measures so that we can make improvements. Questionnaires may be sent to experts or institutions we are in contact with.

    The legal basis for this processing is your consent, cf. GDPR Article 6(1)(a). When NOKUT sends out surveys, we collect IP addresses. IP addresses are registered for technical reasons when the questionnaire is opened and will automatically be deleted after a few days. Names and email addresses are deleted by NOKUT each time a project is completed.

    Data from the surveys are sometimes transferred to Sikt's research archive to make data available for research. Directly identifiable personal data such as names and email addresses are not stored by Sikt. Sikt stores personal data that can indirectly identify you, such as age, gender, and educational institution (applies to small educational institutions), only if you consent to this.

    We use the survey tool SurveyXact, and our supplier and data processor for the tool is Rambøll.

  • In connection with your assignment for NOKUT's board or appeals committee, NOKUT will process personal data about you that are necessary to manage responsibilities arising from the position.

    The processing of personal data will include your name, personal identification number, addresses, phone number, email address, and bank account number.

    If you are not a Norwegian citizen, you need a D-number and a tax card for NOKUT to be able to pay you a fee and for Norwegian authorities to identify you in connection with tax payment. NOKUT uses a copy of your passport to apply for a tax card for you in Norway and to ensure that you receive a D-number or that your old D-number is activated. The legal basis for processing is GDPR Article 6(1)(c) (legal obligation) cf. tax legislation. If you do not already have a D-number, the tax authorities will initiate a process to provide you with a D-number.

    The purposes of processing personal data will be payment of remuneration, reimbursement of travel expenses, and making travel bookings. The legal basis for processing is GDPR Article 6(1)(b) – the processing is necessary to fulfill an agreement you are a party to, and Article 6(1)(c) – (legal obligation) cf. the Tax Administration Act, the Accounting Act, the Freedom of Information Act, the Public Administration Act, and the Archives Act.

    In connection with travel, the legal basis is consent cf. GDPR Article 6(1)(a) or legitimate interest, cf. GDPR Article 6(1)(f). In the latter case, we have weighed the consideration of privacy against the consideration of making an efficient travel booking for you.

    NOKUT is the data controller for the personal data entered into the travel portal of our travel agency, while the travel agency will be the data controller for other matters related to the travel.

    For personal data related to accounting regulations, there is an obligation to retain the data for 10 years. Personal data related to the position itself follows the preservation rules according to archival legislation.

  • 9.1 Recruitment of Potential Experts

    NOKUT contacts potential experts. If you are interested in being an expert for an assignment at NOKUT, NOKUT processes personal data about you that are necessary to assemble an expert committee. The legal basis for processing is GDPR Article 6(1)(f) – legitimate interest.

    We collect information such as name, phone number, email address, workplace, CV, and any previous assignments with NOKUT. If you consent to being an expert for NOKUT, this information will be shared with applicants for accreditation or the institution where we will conduct supervision or evaluation, so they can provide feedback on the committee proposal before it is appointed.

    If you do not wish to be an expert for NOKUT, we will delete the information we have collected. We may also ask if you want to be included in an expert register.

    9.2 Expert Register

    If you wish to be included in NOKUT's expert register, we can more easily find you to ask if you want to be an expert in new assignments. We will then store and process personal data about you that are necessary to assemble an expert committee. The legal basis is consent, cf. GDPR Article 6(1)(a). We collect information such as name, phone number, email address, workplace, CV, and any previous assignments with NOKUT.

    If at any point you no longer wish to be included in the register, you can contact us so we can delete the personal data you have provided.

    9.3 Recruitment of Potential Examiners

    NOKUT has been tasked by the Ministry of Education to administer the examiner scheme for certain national exams. We receive suggestions for examiners from various institutions within the education sector, from professionals, or potential examiners may contact NOKUT themselves. In this context, we process personal data such as name, title, email address, phone number, and institutional affiliation. The legal basis for these personal data will be GDPR Article 6(1)(f) – legitimate interest. The legitimate interest will be the opportunity for you to serve as an examiner, as well as the need to compile an examiner list.

    If you consent to serving as an examiner, your personal data along with a mini-CV will be sent to the relevant educational institution, which then appoints the examiners. The legal basis in this case will be your consent, cf. GDPR Article 6(1)(a).

    If you do not wish to serve as an examiner, your personal data will be deleted.

    9.4 Assignment as Expert or Examiner for NOKUT

    If you are appointed as an expert for NOKUT or as an examiner for national exams, NOKUT will process personal data about you that are necessary to pay wages and manage the responsibilities arising from the assignment.

    The processing of personal data will include name, personal identification number, address, phone number, email address, and bank account number.

    If you are not a Norwegian citizen, you need a D-number and a tax card for NOKUT to be able to pay you a fee and for Norwegian authorities to identify you in connection with tax payment. NOKUT uses a copy of your passport to apply for a tax card for you in Norway and to ensure that you receive a D-number or that your old D-number is activated. The legal basis will then be GDPR Article 6(1)(c) (legal obligation) cf. tax legislation. If you do not already have a D-number, the tax authorities will initiate the process for you to receive a D-number.

    The purposes of processing personal data will be payment of remuneration, reimbursement of travel expenses, and travel bookings. The legal basis for processing is GDPR Article 6(1)(b) – the processing is necessary to fulfill an agreement you are a party to, and Article 6(1)(c) – (legal obligation) cf. the Tax Administration Act, the Accounting Act, the Freedom of Information Act, the Public Administration Act, and the Archives Act.

    In connection with travel, the legal basis is consent cf. GDPR Article 6(1)(a) or legitimate interest, cf. GDPR Article 6(1)(f). In the latter case, we have weighed the consideration of privacy against the consideration of making an efficient travel booking for you.

    NOKUT is the data controller for the personal data entered into the travel portal of our travel agency, while the travel agency will be the data controller for other matters related to the travel.

    For personal data related to accounting regulations, there is an obligation to retain the data for 10 years. Personal data related to the assignment itself follows the preservation rules according to archival legislation.

  • NOKUT's appeals committee for higher education and higher vocational education, represented by the chair, is the data controller for the processing of personal data in connection with complaint handling within its areas of responsibility.

    NOKUT acts as the secretariat for the two aforementioned appeals committees. NOKUT's administrative archive system Public 360, Microsoft Outlook email, and SharePoint are used in case processing. NOKUT is the data controller for the personal data we process about you in NOKUT's case processing and archive systems.

    The purpose of processing your personal data is to carry out the tasks of NOKUT's appeals committees. The legal basis is to exercise public authority and perform a task in the public interest, cf. GDPR Article 6(1)(e), cf. the Universities and Colleges Act and the Vocational Education Act, as well as the Study Quality Regulation § 7-1.

    NOKUT and NOKUT's appeals committees process personal data provided to the appeals committees in connection with complaints. NOKUT's appeals committees receive this information from NOKUT, or possibly the Directorate for Higher Education and Skills.

    NOKUT processes personal data to fulfill tasks according to, among others, the Public Administration Act, the Freedom of Information Act, and archival legislation. Personal data related to complaint handling are archived according to archival legislation.

  • NOKUT uses the Public 360 archive and case processing system with electronic journaling and electronic storage of documents. Public 360 is provided by Tietoevry and follows public standards (NOARK). NOKUT processes personal data to fulfill our statutory tasks according to, among others, the Universities and Colleges Act, the Vocational Education Act, the Education Act, the Public Administration Act, the Freedom of Information Act, and the Archives Act.

    According to the Archives Act § 6, we have an archival obligation. NOKUT registers various types of personal data in Public 360. This may include information such as name, personal identification number, address, phone number, email address, and other relevant information that appears in the inquiry and that we are required to archive.

    NOKUT is required to make its public post journals available to the public, which are published on eInnsyn.no. A journal is a systematic and continuous registration of all incoming and outgoing documents that are subject to case processing and have value as documentation.

    The legal basis for processing is GDPR Article 6(1)(c) (legal obligation). Registration, storage, and retention are carried out in accordance with archival legislation.

  • Changes may be made to the NOKUT Privacy Statement. Date of last change: 14. March 2025.