This guide describes how the DAC shall proceed in connection with request for data access in FEGA Norway under the control of the members of the DAC. The guide also provides a generic overview of the ethical and legal framework that should be in place before such access can be accepted, including requirements set forth in General Data Protection Regulation (GDPR).
Reviewing requests for data access to a dataset submitted in FEGA Norway
The responsible researcher must forward the request for data access to the DAC represented by the PI for the dataset. Before the DAC can complete the request for access evaluation, the researcher is responsible for providing the DAC with following documentation:
- Documentation of legal basis for the project from the researcher’s institution normally represented by the institutions Data Protection Officer (DPO).
- REK approval, including the approved research protocol.
- Copy of Data Protection Impact Assessment (if applicable).
When the relevant documentation has been provided (or processes to generate them has been started), the DAC can proceed with the following:
- Negotiate a Data Access Agreement (DAA)
- It is important that DAC adheres to its own institution's guidelines for which agreement templates are to be used. FEGA Norway has developed generic Data Access Agreement templates of different types:
- Before signing the DAA and proceeding with the approved data access, the DAC is
responsible to file a notification about the access through standard mechanisms for
notification on projects containing sensitive data in your institution. Such notification
should contain the following attachments:
- Copy of the final version of the DAA.
- Documentation from the researcher requesting the data access (above).
- After receiving internal approval from your Research Support Unit or DPO, the DAC can
proceed the formalization and signing of the DAA. It`s important that the DAA is signed
by a authorized person from your institution.
- The signed final version of the DAA should then be filed according to your institution's internal procedures.
We strongly advice the DAC to seek assistants from your own institution`s support units and/or DPO in handling requests for access to datasets in FEGA Norway. The steps described above shall be considered as generic and therefor can deviate from your institution`s internal routines.