Person or body responsible for research or data controller
The Rector is the highest authority responsible for research activities at UiB. The person or body responsible for research in research projects is the person who exercises responsibility on behalf of the Rector. The Dean is the research responsible and has overall responsibility for all research projects at the faculty. The Dean may delegate tasks to the Head of Department. The project leader is responsible for the daily operation of the research project.
In the Research Ethics Act and the Health Research Act, the term person or body responsible for research is used, while data protection regulations use the term data controller for the person responsible for handling personal data. Here, research responsible is used as a collective term.
The research responsible must ensure that research is conducted in a way that upholds ethical, medical, health-related, scientific, data protection, and information security standards from planning to completion, including the post-project management of research data and human biological material.
The research responsible must:
- Ensure training, routines, infrastructure, and internal control systems for research activities in accordance with applicable laws and guidelines, and ensure these are implemented and followed in practice.
- Maintain an overview of their research portfolio in the project registry.
- Stop research that is ethically or legally indefensible or that deviates from the project's established conditions.
- Implement systematic measures that promote good research practices and ensure that research is planned, organized, conducted, and concluded in accordance with applicable regulations.
- Conduct data protection impact assessments where required under the General Data Protection Regulation (GDPR).
- Involve the institution’s data protection officer appropriately and in a timely manner in matters affecting the privacy of research participants.
Project manager
The project manager has operational responsibility and must ensure internal control throughout the research project, from planning to completion, ensuring compliance with relevant laws, requirements, and guidelines.
The project manager must:
- Consult with the institution’s data protection officer if the processing of personal data is likely to pose a high risk to individuals’ rights and freedoms, requiring a data protection impact assessment under GDPR Article 35.
- Prepare a data management plan.
- Ensure access control if confidentiality is required in processing personal data for the project.
- Ensure that relevant and necessary documentation requirements are met within the project.
- Familiarize themselves with relevant legislation on personal data processing and applicable information security guidelines when using UiB’s IT infrastructure, including UiB’s research server SAFE.
- Follow up on research participants' requests for access to their data, etc.
- Handle breaches of personal data security.
- Ensure that necessary agreements are in place to maintain information security and data protection.
- Supervise student projects below the doctoral level. The supervisor is responsible for ensuring that students are aware of UiB’s guidelines and procedures for handling personal data and recognized ethical research standards and guidelines.
Medical and Health Research
For medical and health research, these additional guidelines apply:
- The supervisor is the responsible project leader for doctoral research projects.
- The project leader is responsible for submitting the necessary application to the Regional Committee for Medical and Health Research Ethics (REK).
- The project manager must ensure that serious, unexpected, and adverse medical incidents are reported to the research responsible and the Norwegian Board of Health Supervision. Research participants must also be immediately informed if they have suffered harm or if complications have arisen due to the research project.