When we ‘process personal data’, it means, for example, that we collect data, register them, combine them, store them or disclose them.
The UDI is obliged to process your personal data in a lawful and secure way. This page describes how we process your personal data and what your rights are as a person registered in our systems.
The UDI collects and uses personal data in order to carry out the following tasks:
We can normally only use your personal data for the tasks for which they were obtained. However, the UDI has a duty to control and verify information we receive in immigration and citizenship cases. This means that we can use information from your previous immigration cases when considering a new case. We can also use information from another person’s case if it is necessary to consider your case.
When the immigration administration processes personal data, we do so within the framework of the Immigration Act, the Norwegian Nationality Act and pertaining regulations. The UDI has its own powers to process personal data in, among other regulations, the Immigration Act section 83a. The UDI may therefore process personal information necessary to carry out the tasks mentioned in paragraph 1.
The UDI needs to collect necessary information from you because you are applying for a residence permit or have another case under consideration. You must help to clarify your identity and have a duty to provide information that may be relevant to your case (see the Immigration Act Section 83).
If necessary, the UDI can also collect information from other public agencies, such as the Norwegian Tax Administration, the Norwegian Labour and Welfare Administration (NAV), the State Educational Loan Fund (Lånekassen), the Population Register, the child welfare services or the police (see Section 84 of the Immigration Act and Sections 17-7a to 17-7g of the Immigration Regulations). We can also collect information from publicly available sources, such as websites and social media.
The UDI processes personal data that are necessary to carry out the tasks given in section 1. Which specific personal data we process about you depends on the task we need to solve. You will receive more information about this during the case processing.
There are some data that the UDI will process regardless of the type of case, for example data on
The UDI registers your personal data in different registers that we are responsible for keeping:
We also register certain data in European information systems:
The immigration authorities in Norway consist of several agencies that carry out different tasks. The foreign service missions and immigration sections of the various police districts accept and prepare for example applications for residence permits, while the National Police Immigration Service (PU) accepts and registers applications for protection. The UDI decides cases such as applications for protection, residence permits and Norwegian citizenship. The Immigration Appeals Board (UNE) processes appeals concerning the UDI’s decisions.
The staff at the different immigration authorities use different case processing systems and through these, gain access to data that are registered about you in our databases. The staff are only to process your personal data when it is necessary to carry out their work.
We protect the data stored in the registers in different ways, for example by using firewalls and controlling who has access to our buildings. Only authorised persons are allowed to access your personal data and we control how they process personal data in our data systems.
The UDI has a duty of secrecy and can only disclose your personal data if it is stated in the law that we can, or if you consent to it.
Several public agencies are entitled to collect information from the UDI, such as the Norwegian Tax Administration, NAV, Lånekassen, the Population Register and the police. We also have a duty to disclose information to other countries in Europe that cooperate on control of national borders, visa regulations, police duties and processing of asylum applications (countries that participate in the Schengen Agreement and the Dublin Regulation).
We also disclose certain information to international organisations and special interest organisations that help us in immigration cases, such as the Norwegian Organisation for Asylum Seekers (NOAS) and the International Organization for Migration (IOM). Businesses and individuals that carry out work for the UDI can also be given access to information that is necessary to their work, for example those running a reception centre.
The UDI can also disclose information that is not subject to a duty of secrecy to other public agencies and to businesses and individuals. For example, we disclose information to the Labour Inspection Authority and employers about whether a person has a right to work in Norway.
The UDI will store your personal data as long as they are necessary to solve the tasks given in section 1. After that, your personal data can be transferred to the National Archives (see the Archives Act).
The UDI is the data controller. This means that we are responsible for how your personal data are processed in the UDI and at the asylum reception centre in connection with the tasks named in section 1. We are also responsible for the personal data filing systems UDB, the register of foreign nationals and the parts of EURODAC and VIS that concern Norway.
If you are registered in the immigration authorities’ registers, you have the following rights pursuant to the Personal Data Act.
You have a right to be given information about
If you discover that the UDI has registered incorrect, outdated or incomplete information about you, you have a right to have this corrected or updated.
If you believe that the UDI does not process your personal data in the way required by the law, you can appeal to the Norwegian Data Protection Authority. Information about application procedures is available on the Data Protection Authority’s website. (external website)
Personal data stored in the Immigration Database is required for the UDI to carry out its tasks, for scientific and historical research, for statistical purposes and for archival purposes, and as a general rule you will not be entitled to delete these, cf. privacy regulation, article 17, no. 3.