Privacy statement

This privacy statement describes how NOKUT processes personal data. NOKUT is committed to ensuring the privacy, confidentiality and availability of personal information.

  • This Privacy statement describes how NOKUT collects and processes personal data. All processing of personal data by NOKUT shall comply with the applicable data protection legislation, including the Norwegian Personal Data Act and the EU General Data Protection Regulation (GDPR). We have implemented appropriate technical and organisational measures to protect the confidentiality, availability and integrity of your personal data. Personal data are used solely for the specified purposes, and access is restricted to authorised employees with a work-related need, based on role-based access control and two-factor authentication. Our systems are secured through measures such as passwords, access controls, logging, and continuous staff training. All employees are subject to a duty of confidentiality.

    An overview of the categories of personal data we process and the purposes of such processing is provided in Sections 4–15.

    NOKUT uses external service providers that may process personal data on our behalf (data processors). We ensure that data processing agreements are entered into with our processors, enabling NOKUT to monitor that the processing is carried out in accordance with data protection legislation. NOKUT uses Advania Norge AS as provider of IT services, Tietoevry Norway AS as provider of archive systems, DFØ as provider of payroll and accounting services, and Rambøll as provider of survey services. A complete list of data processors may be provided upon request.

    As a general rule, NOKUT does not transfer personal data to countries outside the EU/EEA (third countries). In exceptional cases, personal data may be transferred where data processors located in third countries are granted access to personal data stored within the EU/EEA. In such cases, NOKUT will ensure that an appropriate transfer mechanism is in place and that the personal data are subject to an adequate level of protection.

    We process requests for access, rectification, and deletion without undue delay and normally within 30 days.

    If you believe that we are processing personal data in violation of the privacy regulations, you can file a complaint with NOKUT's Data Protection Officer. You also have the option to complain to the Norwegian Data Protection Authority (Datatilsynet)

  • NOKUT is the data controller for the processing of personal data where NOKUT determines the purpose of the processing. NOKUT can be contacted via:

    Email: postmottak@nokut.no
    Address: Postboks 578, 1327 Lysaker

    NOKUT has its own Data Protection Officer. You can contact the Data Protection Officer with questions about your rights and the processing of your personal data. The Data Protection Officer can be contacted via:

    Email: personvernombud@nokut.no

    Please note that regular email may be unencrypted. We encourage everyone who wishes to send us sensitive personal data via email, such as personal identification numbers, to use encryption.

  • Anyone who has personal data registered about themselves in NOKUT's systems has the right to:

    • Access the personal data
    • Rectify incorrect and incomplete personal data
    • Delete personal data
    • Restrict the processing of personal data
    • Data portability
    • Object to the processing of personal data

    If the processing of personal data is based on your consent, you can withdraw your consent at any time. However, this does not affect the legality of the processing before the consent is withdrawn.

    The legislation allows us, in some cases, to make exceptions to the right to deletion. For example, this will be the case when we need to store the personal data to fulfill a task we are required to do by law, or to safeguard important societal interests such as archiving, research, and statistics.

    We process requests for access, rectification, and deletion without undue delay and normally within 30 days.

    If you believe that we are processing personal data in violation of the privacy regulations, you can file a complaint with NOKUT's Data Protection Officer. You also have the option to complain to the Norwegian Data Protection Authority.

  • As a public authority, NOKUT is obliged under archival legislation to maintain archives and to archive personal data that form part of case processing or have value as documentation. Archival legislation takes precedence over data protection legislation. Archiving is considered to be compatible with the original purposes of the processing, cf. Article 5(1)(b) of the General Data Protection Regulation.

    The journal (i.e. the register of documents that we create, receive, or send) shall be made publicly available on the internet via eInnsyn.no. Anyone may request access to the registered case documents. NOKUT will not grant access to information relating to an individual’s personal affairs, as such information is subject to a duty of confidentiality, cf. section 13 of the Public Administration Act. The duty of confidentiality pursuant to section 13 of the Public Administration Act does not encompass all personal data as defined under data protection legislation.

    4.1 Use of Artificial Intelligence in Case Processing at NOKUT

    NOKUT uses artificial intelligence (AI) to increase the efficiency of its case processing.
    The purpose of the processing is to support NOKUT’s case officers in the assessment and handling of documentation from institutions and other entities in connection with accreditation, supervision, and evaluations. The AI tool is used to analyse and structure large volumes of text, data from surveys, and public register data; to extract material information; to perform searches and reference management; and to generate summaries and proposals for structured information. The tool functions solely as a decision-support tool and shall not make decisions or reach conclusions.

    The processing mainly concerns information relating to employees of the relevant entities, including name, job title, role, qualifications, education, employment relationship, and participation in professional processes. In addition, data from surveys conducted among students and other stakeholders, as well as public register data, are processed.

    The AI tool does not collect information from external sources and does not establish new registers.

    The system does not replace the professional judgment of the case officer. It functions exclusively as a decision-support tool for case officers; it does not make automated decisions, does not profile individuals, and is not used to link data across cases. All decision-making authority rests with NOKUT’s case officers. AI analyses are logged and can be subject to verification by reference to the underlying documentation and the relevant case reference.

    The processing is carried out as part of NOKUT’s statutory tasks relating to accreditation, supervision, and evaluations, cf. sections 3-3, 3-6, and 16-3 of the Universities and Colleges Act and sections 4 b, 5, and 5 a of the Vocational Education Act, cf. Article 6(1)(e) of the General Data Protection Regulation – processing that is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. The AI tool is used solely as an auxiliary aid in the performance of these tasks.

    Data are not used for the training of the supplier’s AI models and are not shared with other third parties.

    Working data and technical logs from the use of the AI tool and system activity (for example, which prompts are submitted to the AI tool) are stored for up to 90 days for security and auditability purposes, after which they are anonymised or deleted.

    Personal data that are not used in case processing are deleted.

  • 5.1 Cookies

    NOKUT uses cookies on its website. Cookies are small text files that are temporarily stored on the device you use when visiting the website, in order to ensure functionality and an improved user experience. For further information, please refer to our cookie statement (coming soon).

    5.2 Newsletters

    You may subscribe to electronic newsletters from NOKUT. The legal basis for this processing is your consent, cf. Article 6(1)(a) of the General Data Protection Regulation. In order to send emails to the correct recipient, NOKUT must store your email address. When you unsubscribe from the newsletter, your email address will be deleted.

    5.3 Sharing Function

    Visitors to our website may share selected articles on the social media platforms Facebook, X, and LinkedIn by using the sharing buttons available on our pages. In this connection, the aforementioned platforms may process your personal data. Please see the links to their respective privacy statements under section 14.

  • When NOKUT hosts events, we use the electronic registration form on our website. If you register for an event, you consent to us storing personal data about you for use in the specific event. We need this information to know which participants are registered and to send out a questionnaire for event evaluation.

    You can consent to us retaining your personal data (name, email, and information about which events you participated in) so that we can invite you to other relevant events in the future. If you do not consent to this, we will delete your information after the event is completed.

    Information processed in connection with direct billing to participants follows accounting legislation, and we are required to keep it in the accounting system for 10 years. In this context, your name and address are processed.

    NOKUT occasionally takes portrait or situational photos at events and publishes them on the internet, in written reports, or articles. NOKUT's legal basis for this will be GDPR Article 6(1)(a), i.e., your explicit consent, or Article 9(2)(a).

    For meetings and events, NOKUT invites participants to inform us about foods they do not eat (dietary preferences). Information about allergies is a special category of personal data. In most cases, it is not necessary to state that a dietary preference is due to an allergy. NOKUT's legal basis for processing information about dietary preferences, or allergies, will be your explicit consent, cf. Article 9(2)(a). You can withdraw this consent at any time. Withdrawing your consent will not affect the legality of the processing that occurred while your consent was valid.

  • 7.1 General

    If you apply for a position at NOKUT, we process personal data relating to you in order to evaluate your application. The personal data may include your name, address, email address, telephone number, profile photo, CV, reference interviews, diplomas, and certificates. The legal basis for the processing of your personal data is your consent, cf. Article 6(1)(a) of the General Data Protection Regulation.

    NOKUT uses the recruitment tool Jobbnorge. The tool is provided by Grade Jobbnorge AS, which acts as a data processor for NOKUT. Job applications are deleted from Jobbnorge after one year. Any diplomas, certificates, and other attachments uploaded by you as an applicant in Jobbnorge are also deleted at that time.

    Where the pool of applicants includes candidates who have a disability requiring workplace accommodation, who have an immigrant background, or who have had periods of absence from work, education, or training for at least two of the past five years, NOKUT is obliged to invite at least one qualified candidate from among these groups to an interview. Information relating to such circumstances constitutes, as a general rule, special categories of personal data. Providing such information in connection with a job application is voluntary. Where applicable, NOKUT’s legal basis for processing will be Article 9(2)(b) of the General Data Protection Regulation, cf. sections 4–4b of the Regulations to the Act relating to State Employees.

    In the recruitment process, NOKUT will process personal data that is necessary to fulfill our legal obligations (GDPR Article 6(1)(c)) under the State Employee Act (only in Norwegian), the Public Administration Act, the Freedom of Information Act, and the Archives Act (only in Norwegian).

    7.2 Interviews and references

    In connection with the conduct of interviews, NOKUT may also prepare internal notes in Jobbnorge. NOKUT will only record information that is considered relevant to the assessment of whether an applicant is suitable for the position in question. Such notes are deleted from Jobbnorge after 12 months.

    In addition to interviews, NOKUT may carry out its own checks, typically by collecting references from the referees you provide. For this purpose, NOKUT uses the reference tool Refapp. The personal data stored consist of assessments and information relating to your current or previous employment. The data are automatically deleted after 12 months.

    For managerial positions, NOKUT uses an external recruitment agency. In such cases, you may be asked to complete personality and/or aptitude tests. Processing of the test results requires your consent, cf. Article 6(1)(a) of the General Data Protection Regulation, which may subsequently be withdrawn. The test results are not shared with NOKUT and are managed in their entirety by the external recruitment agency.

    7.3 Lists of applicants

    Pursuant to section 25 of the Freedom of Information Act, NOKUT is obliged to grant access to lists of applicants. The applicant list will contain the name, age, position or occupational title, and municipality of residence and workplace for each applicant. An exemption from public access may be granted in respect of information relating to you as an applicant, provided that you request such an exemption. In the assessment of whether such a request should be granted, particular weight shall be given to whether the position is of special public interest. Documents in cases concerning appointment or promotion in the public service may also be exempt from public access.
    In this context, the purpose is to provide the general public with transparency regarding public appointments. The legal basis for the processing is Article 6(1)(c) of the General Data Protection Regulation (legal obligation), cf. section 25 of the Freedom of Information Act.

    NOKUT is obliged to retain applicant lists in accordance with archival legislation.

  • NOKUT conducts surveys to assess views on the quality of education. To reach the correct recipients, NOKUT obtains names, telephone numbers, and email addresses from the Common Student System (FS), the Database for Statistics on Higher Education (DBH), educational institutions, or other organisations, depending on the purpose of the survey. If you open a questionnaire, your IP address will be registered for technical reasons.

    The legal basis for the processing of personal data is Article 6(1)(e) of the General Data Protection Regulation – the processing is necessary for the performance of a task carried out in the public interest which NOKUT is mandated to perform under the Universities and Colleges Act or the Vocational Education Act. If you choose to respond to the survey, the legal basis for the processing of your responses is your consent, pursuant to Article 6(1)(a) of the General Data Protection Regulation.

    Names, email addresses, and telephone numbers are deleted after the survey has been concluded and NOKUT has quality-assured the results. IP addresses are automatically deleted after a few days. Indirectly identifiable information is stored by NOKUT for a specified period if you consent to this for analysis and research purposes. Data from certain surveys are transferred to the National Research Archive (Sikt) for research purposes and are retained there for a specified period depending on the survey in question. Sikt stores personal data that can identify you only if you consent to this.

    We use the survey tool SurveyXact, and our supplier and data processor for the tool is Rambøll. Their processing of personal data is governed by a data processing agreement.

  • NOKUT has a Board and two Appeals Boards for its decisions – one for higher education and one for higher vocational education. Members of the Board and the Appeals Boards are appointed by the Ministry of Education. NOKUT itself recruits expert committee members to assist in accreditation cases, supervision, and evaluations of education, as well as examiners for assessing submissions in national examinations.

    In connection with the recruitment of experts and examiners, and in administering the engagement of persons who perform assignments for NOKUT, we process personal data.

    9.1 Recruitment of potential experts

    NOKUT contacts potential experts. If you are interested in serving as an expert on an assignment for NOKUT, NOKUT will process personal data about you that are necessary to assess the composition of an expert committee.

    We collect information such as name, telephone number, email address, place of employment, CV, and any previous assignments for NOKUT. If you consent to serve as an expert for NOKUT, this information will be shared with applicants for accreditation or with the institution where we will conduct supervision or evaluation, so that they may provide feedback to NOKUT on the proposed committee before it is appointed.

    The legal basis for the processing is our legal obligation to use external experts in accreditation and in supervision of quality assurance and accreditation conditions, cf. section 3-3 of the Universities and Colleges Act, section 1-21 of the Regulations under the Universities and Colleges Act, and section 46 of the Regulations under the Vocational Education Act, cf. Article 6(1)(c) of the General Data Protection Regulation.

    If you do not wish to serve as an expert for NOKUT, we will delete the information we have collected. We may also ask whether you wish to be listed in a register of experts. If you wish to be included in the expert register, it will be easier for us to identify you when requesting experts for new assignments. The same personal data as mentioned above will then be processed. The legal basis for this processing is your consent, cf. Article 6(1)(a) of the General Data Protection Regulation. If at any point you no longer wish to be included in the register, please contact us so that we can delete the personal data you have provided.

    9.2 Recruitment of potential examiners

    NOKUT has been tasked by the Ministry of Education with administering the examiner scheme for certain national examinations. We receive proposals for examiners from various institutions in the knowledge sector and from professionals. Potential examiners may also contact NOKUT directly. In this context, we process personal data such as name, title, email address, telephone number, and institutional affiliation.

    The legal basis for processing the personal data of examiners is to fulfil NOKUT’s legal obligation to administer the examiner scheme, cf. Article 6(1)(c) of the General Data Protection Regulation, cf. section 22 of the Regulations on National Curriculum Regulations for Nursing Education, section 5 of the Regulations on Framework Plans for Primary and Lower Secondary Teacher Education for Years 1–7 and 5–10, and sections 13 and 14 of the Regulations on National Guidelines for Master’s Degree in Child Welfare.

    If you consent to serve as an examiner, your personal data together with a short CV will be sent to the relevant educational institution, which then appoints the examiners. In this case, the legal basis for the processing is your consent, cf. Article 6(1)(a) of the General Data Protection Regulation.

    If you do not wish to serve as an examiner, your personal data will be deleted.

    9.3 Administration of the assignment/task

    In connection with your assignment or task for NOKUT, we will process personal data about you that are necessary for administering remuneration and any travel. The personal data include name, national identity number, address, telephone number, email address, and bank account number. NOKUT also publishes photographs of the Board and expert committees on the internet and/or in written reports.

    The legal basis for the processing is compliance with NOKUT’s legal obligations under the Working Environment Act, the State Employees Act, tax and reporting legislation, archival legislation, the Public Administration Act, the Universities and Colleges Act, and the Vocational Education Act, cf. Article 6(1)(c) of the General Data Protection Regulation. The legal basis for processing photographs of Board members and experts is consent, cf. Article 6(1)(a) of the General Data Protection Regulation.

    In order to administer remuneration to persons who are not Norwegian citizens, NOKUT must have access to the individual’s D-number. NOKUT uses a certified copy of the person’s passport to apply for a tax deduction card in Norway and to ensure that the person’s existing D-number is reactivated or that a new D-number is assigned.

    The legal basis for processing personal data in connection with administering a D-number is our legal obligation under section 3 of the A-Reporting Act (a-opplysningsloven) and related statutory provisions, cf. Article 6(1)(c) of the General Data Protection Regulation.

    When you travel on behalf of NOKUT, NOKUT processes your personal data to arrange the booking. The personal data include name, email address, and telephone number, and in certain cases date of birth (for intercontinental travel, domestic travel in the USA, youth tickets, or travel with British Airways). NOKUT uses the travel agency Berg-Hansen. The travel agency is the controller for the data relating to the trip, and the processing is governed by a data processing agreement.

    NOKUT is obliged to retain your travel expense claims and documentation of fees paid for ten years after the end of the financial year, pursuant to accounting legislation, cf. Article 6(1)(c) of the General Data Protection Regulation.

  • NOKUT acts as the secretariat for the Appeals Board for Higher Education and the Appeals Board for Higher Vocational Education. In performing the secretariat function, NOKUT processes personal data contained in the complaint – normally contact details and/or information about the position/function of employees or persons holding an office at the institution.

    The purpose of the processing is to facilitate the handling of complaints by the Appeals Boards, based on Article 6(1)(e) of the General Data Protection Regulation – the processing is necessary for the exercise of official authority that NOKUT is mandated to perform, cf. sections 33 and 17 of the Public Administration Act.

    NOKUT’s Appeals Boards are controllers for the processing of personal data in connection with complaint handling within their respective areas of responsibility.

  • On assignment from the Ministry of Education, NOKUT administers national examinations in specific types of study programmes. In this context, NOKUT processes personal data about the students taking the relevant examination. The data are anonymised. Identification of individuals is only possible by linking to information from the educational institution’s access-restricted student register, based on categories such as age, gender, educational institution, average grades from upper secondary school, grade information from the study programme, and semester of admission.

    The legal basis for the processing is the exercise of official authority that NOKUT is mandated to perform, cf. Article 6(1)(e) of the General Data Protection Regulation, cf. section 22 of the Regulations on National Curriculum Regulations for Nursing Education, section 5 of the Regulations on Framework Plans for Primary and Lower Secondary Teacher Education for Years 1–7 and 5–10, and sections 13 and 14 of the Regulations on National Guidelines for Master’s Degrees in Child Welfare.

    The personal data are retained for analysis purposes. Datasets from national examinations may be disclosed for research. Necessary measures are implemented to safeguard candidates’ privacy, for example through de-identification and the establishment of a minimum threshold for the number of candidates included in a dataset.

  • NOKUT supervises educational institutions to assess their systematic quality assurance work, compliance with regulations related to finance and administration, and the quality of study programmes. We also conduct evaluations of the quality of study programmes at the institutions. Furthermore, we carry out audits of student welfare organisations and subordinate entities of the Ministry of Education to assess compliance with regulations.

    When we initiate supervision or conduct evaluations and audits, we request information from the entity that is not available to us from other sources and that is necessary to carry out the task. We typically process personal data such as contact details and/or information about the position/function of employees or persons holding an office at the entity.

    The purpose of the processing is to verify that the entity complies with regulatory requirements relating to finance and administration, quality assurance and accreditation, or to assess the quality of study programmes. The legal basis for the processing is the exercise of official authority that NOKUT is mandated to perform under the Universities and Colleges Act and the Vocational Education Act, cf. Article 6(1)(e) of the General Data Protection Regulation.

  • NOKUT processes applications for accreditation of study programmes and institutions and, in this connection, processes personal data that appear in the application or through our contact with the institution. The personal data processed typically consist of contact details and/or information about the position/function of employees or persons holding an office at the entity.

    The purpose of the processing is to assess the extent to which the entity meets the requirements for the relevant accreditation. The legal basis for the processing is the exercise of official authority that NOKUT is mandated to perform under the Universities and Colleges Act and the Vocational Education Act, cf. Article 6(1)(e) of the General Data Protection Regulation.

  • NOKUT is present on the social media platforms Facebook, LinkedIn, and YouTube in order to reach the public with relevant information. These platforms are used as a supplement to our website.

    When you use social media, the platform owner will process personal data about you. Please refer to the platforms’ own privacy rules here: Facebook, LinkedIn, and YouTube (Google).

    Where the platform owner provides NOKUT with analytics and statistics for NOKUT’s page/profile on the platform, NOKUT has joint controllership with the platform owner. See the joint controllership arrangements with Facebook and LinkedIn. See also the joint controllership arrangement with YouTube (Google).

    The legal basis for the processing of personal data is NOKUT’s legitimate interest in maintaining public visibility and disseminating relevant information, cf. Article 6(1)(f) of the General Data Protection Regulation. Our assessment is that NOKUT’s presence on these platforms is, overall, to the public’s benefit and does not create specific privacy risks for users of the platforms.

    On the training of AI models

    The platforms use users’ content on the platform to train their AI models. LinkedIn has enabled users to opt out of this in the profile settings (see LinkedIn’s guidance). If you do not want Facebook (Meta) to use content you have published for training its AI model, you may object – see the Norwegian Data Protection Authority’s guidance on this (in Norwegian).

  • When visiting our premises, you may provide your contact details in an electronic form at reception. The legal basis for the processing is our legitimate interest in ensuring that the appropriate person is notified of your arrival, cf. Article 6(1)(f) of the General Data Protection Regulation.

  • Changes may be made to the NOKUT Privacy Statement. Date of last change: 21. January 2026.