Considerations for new systems
- Be prepared with a Plan B: Some software might not be approved, and the approval process can be time-consuming.
- Identify the need: Describe the problem the system is intended to solve or the benefit it is meant to provide. The use of already approved software is preferred when it meets the need.
Once the IT division's security team has conducted an initial assessment and deemed the service feasible to proceed, feedback will be given to the person who will take on system administrator responsibilities regarding the next steps.
Ensure that important assessments when acquiring or developing new systems/services are carried out and documented.
Register a new system, service or application here
Templates and guidelines
Data processor agreement template (English version) (Word file)
Data processor agreement template (Norwegian version) (Word file)
Documents available in Norwegian only:
System and service procurement procedure (for system and service owner)
System and service procurement guideline (for system administrators, system manager, IT and technical personnel)
Checklist for data processor agreements
Risk assessment report (final report template)
Next steps
- Privacy risk assessment - adequate privacy protection in the solution [link]
- Risk assessment - adequate security controls in the solution [link]
- Establish data processor agreement
- DPIA (Data Protection Impact Assessment) must be carried out in some cases
- System integrations
- System integrations are often complex and require the expertise and involvement of multiple groups: development needs to be carried out, a data processor agreement must be established, the solution must ensure stable operations, be redundant and scalable, rights must be delegated, documentation must be produced, and the service portfolio must be updated with plans and budgets.
- Authentication solutions
- Service Level Agreement (SLA)
- Country of data storage
- The General Data Protection Regulation (GDPR) applies to all EU member states and is applicable in the EEA, which includes Iceland, Liechtenstein and Norway. When personal data is transferred to a country outside the EEA, that is not subject to GDPR, special safeguards apply to the transfer to ensure the level of protection in the EEA is not undermined.
Questions and answers about new rules for the transfer of personal data to countries outside the EEA (Here you will also find a list of approved third countries) [Norwegian only]
NB! Following the Schrems-II ruling by the EU Court of Justice, transfers to the US are particularly problematic. There is currently no legal basis for implementing new systems that transfer data to the US. This means we cannot implement systems that transfer personal data to the US or other third countries that are not approved. This rule also applies to subcontractors employed by the supplier. Transfer includes activities like remote access, such as for support. More information is available on the Norwegian Data Protection Authority's website.
By transfer of personal data, we mean that the personal data is sent or transferred to another country, or someone in another country gains remote access to the data. For example, if you give a Russian subcontractor access to login and view your data, even if the data is only stored on a server located in Norway, this is considered a transfer.
- The General Data Protection Regulation (GDPR) applies to all EU member states and is applicable in the EEA, which includes Iceland, Liechtenstein and Norway. When personal data is transferred to a country outside the EEA, that is not subject to GDPR, special safeguards apply to the transfer to ensure the level of protection in the EEA is not undermined.
- Access control, administrator rights
If existing options do not address the challenge
Contact UiA Help with the following information:
- Who are the intended users of the service? Specify whether they are staff (academic or administrative), students, research fellows, and provide an approximate number in each category.
- What type of information will the service process? Include examples such as names, email addresses, research data (describe the type), images, videos, chat logs, file uploads, sensitive information, etc.
- Who owns the information to be processed?
- In what situations is the service intended to be used? Will it be mandatory for anyone? Is it for piloting, data analysis, examinations, student activities, or external collaboration?
- Suggest possible alternatives to solve the issue; we should consider at least three different options.
- New solutions involve several tasks that need to be carried out and documented. Who will be the contact person and system administrator for the application? Which division/faculty will own the application and be responsible for the management of the service? This must be clarified with a manager before considering approval.
- All systems must have a system owner and a system administrator. The system owner is always a unit director, while the system administrator role is delegated to a staff member within the unit. The system owner is responsible for the service and is the person who should sign the data processing agreement. The system administrator is tasked with handling information security and privacy within the system/service.