UDI is the data controller. This means that we are responsible for how your personal data is processed within UDI and at asylum reception centres in connection with the tasks mentioned in section 2. We are also responsible for the following personal data registers: the database of foreign nationals (UDB), the register of foreign nationals (Utlendingsregisteret), and the national components of EURODAC (European Dactyloscopy System) and VIS (Visa Information System). 

UDI processes your personal data in order to carry out the following tasks:

• process cases concerning visas, residence permits, protection, exclusion, travel documents, citizenship, rejection, expulsion, repatriation and assisted return 
• control and verify information, for instance to clarify a person's identity, age, and family relationships
• revoke permits, such as residence permits or visas
• offer individuals applying for protection (asylum) a place to live and provide financial support to people residing in asylum reception centres
• facilitate care responsibilities for unaccompanied minor asylum seekers between the ages of 15 and 18 years, and unaccompanied minors with an accompanying person (an adult who is not the minor's mother or father).
• make arrangements for indiviuals with follow-up needs at the asylum reception centre where they live, during the processing of their cases and when they are settled.
• conduct necessary testing of IT solutions and correct IT system errors
• provide guidance to our users
• respond to inquiries from journalists regarding your case if you have consented to this

In some cases, UDI will process personal data in automated processes that are not part of the case processing and do not result in automatic decisions (see section 8), but are necessary for UDI’s administrative tasks.

We can usually only use your personal data for the tasks for which they were obtained. However, UDI has a duty to verify and control information we receive in immigration and citizenship cases. This means that we may use information from your previous immigration cases when processing a new case. We may also use information from another person's case if that person has a connection to you and it is necessary to use the data to verify information in your case.

We also process your personal data to carry out other tasks that are part of UDI's operations, such as when we prepare statistics and analysis reports or improve our services. We do not inform you when we further process your personal data for these purposes.

UDI processes personal data within the framework of the Public Administration Act, the Personal Data Act, and special legislation such as the Immigration Act, the Norwegian Nationality Act, and associated regulations. UDI has its own legal grounds for processing personal data under Section 83 a of the Immigration Act and Section 29 a of the Nationality Act. Therefore, UDI may process personal data that is necessary to achieve the purposes mentioned in section 2. As a general rule, it is not possible to object to such processing (exercise the right to object, cf. the General Data Protection Regulation, Article 21).

UDI collects necessary information from you as an applicant for a residence permit or someone with another case being processed by UDI. You are required to assist in clarifying your identity and have a duty to provide information that may be relevant to your case (see Section 83 of the Immigration Act and Section 29 of the Nationality Act).

If necessary, UDI may also collect information from other agencies. To avoid you having to provide the same information to multiple public authorities, we may, among other things, collect information from:

• The Norwegian Tax Administration, the Norwegian Labour and Welfare Administration (NAV), the State Educational Loan Fund, the child welfare services, or the police

• The National Population Register and the Contact and Reservation Register where applicable

• The Brønnøysund Register Centre regarding the name of your declared employer and place of study

We also collect information from publicly available sources, such as websites and social media.

UDI processes personal data that is necessary to carry out the tasks mentioned in section 2. The specific personal data we process about you depends on the task we are to perform. You will receive further information about this during the processing of your case.

UDI processes some information regardless of the case type, such as information about:

• identity (for example name, date of birth, place of birth, gender, nationality, passport number)
• biometrics (facial photo and fingerprints)
• place of residence and contact information (for example postal address, registered address, email address and phone number)
• relationship to others (for example family, host family, employer, place of study)
• financial situation (for example income, financial support from the public services, assets)
• the immigration case (for example the status of the case, information about what has happened in the case and the grounds for being granted a residence permit)

The UDI Information Service processes personal data to fulfill our duty to provide guidance and to ensure that you, as a user, can safeguard your interests in the best possible way. When you contact us, you may be asked to provide personal data so that we can guide you. If you contact us without providing personal data, we will not be able to offer you guidance on specific cases.

UDI is required to control and verify the information we receive in immigration and citizenship cases. In some cases, the information you provide through our information service may therefore be used as part of the processing of your case. We may also use your contact information to send you information regarding your case.

UDI provides guidance via chat and email for certain questions. To uphold our duty of confidentiality and your privacy, we have limited ability to provide anything other than general guidance via chat and email. UDI can often offer more detailed guidance by phone.

UDI's chatbot provides answers to general questions within selected case types 24/7. The chatbot does not respond to questions that require access to personal data, so we ask that you do not provide personal data during the conversation. When you interact with the chatbot, your message is processed by an AI-based language model. What you write is not used to train or improve the language model. To secure and further develop the service, conversations are temporarily stored for up to 30 days. You may request a copy of the conversation at any time. If you do not want your conversation to be stored, you can ask the chatbot to delete it immediately.

When you contact the UDI Information Service, others than the person you are speaking or chatting with may follow the conversation for training purposes. If this occurs, you will be informed at the start of the conversation. You may then choose to opt out, and others than the case officer will no longer follow the conversation.

UDI processes your personal data in various registers and systems. Below are some examples of the registers and systems we use:

• The database of foreign nationals (UDB) is the main personal data register of the immigration authorities. All information related to immigration and citizenship cases is registered and stored in UDB. Foreign nationals who are registered are given a unique identification number (DUF number). There are also Norwegian nationals registered in UDB, such as representatives, family members, host families, sponsors and employers.
• The Register of Foreign Nationals (Utlendingsregisteret) is a register of biometric data containing fingerprints and facial photographs of individuals from countries outside the EU and EEA area (see Section 100 of the Immigration Act).
• The Person Register (PREG) contains core personal and relationship data. This includes information such as name, surname, citizenship, address, gender, ID documents, date of birth, and more. Relationships such as parents, children, siblings, and spouses are also recorded here. PREG assigns a unique identification number (DUF number).
• UDI Contact Centre is the system UDI uses to receive and register inquiries via phone, email, and chat in the UDI Information Service.
• Mot is a system used by both UDI and asylum reception centres for registering individuals staying in reception centres. It handles the placement of residents, case processing, reception centre finances, resident finances, and monitoring and follow-up of reception centres. Personal data is not registered directly in Mot, but information relevant during a person's stay in a reception centre is available in the system, including name, nationality, reception centre address, gender, date of birth, and relationship data.

We also register certain data in European information systems:

• EURODAC is a register of biometric data containing fingerprints and identity data of individuals from countries outside the EU and EEA area who apply for protection or cross borders illegally. 
• The Visa Information System (VIS) is an information system containing personal data, facial photographs and fingerprints of individuals from countries outside the EU and EEA area who apply for a visitor visa.
• The Schengen Information System (SIS) is an information system containing information about individuals who are not permitted to enter and stay in the EU/EEA area, or who are wanted in connection with criminal acts. The National Criminal Investigation Service (Kripos) is responsible for the part of SIS that concerns Norway.

UDI may decide cases automatically (for information about the use of automated decisions, see Section 17-7 c of the Immigration Regulations and Section 13A-3 of the Citizenship Regulations). This means that we make a decision without a case officer manually assessing the information in the case. We may only process the case automatically when there are clear conditions in the regulations for whether what you have applied for should be granted or rejected. If the case requires any discretionary assessment, it cannot be decided automatically. If you appeal a decision that was made through automated processing, you are entitled to have your appeal considered manually.

The Norwegian immigration authorities consist of several agencies that carry out different tasks. The foreign service missions and immigration sections of the various police districts accept and prepare, for example, applications for residence permits, while the National Police Immigration Service (PU) accepts and registers applications for protection (asylum). UDI decides, among other things, on applications for protection, residence permits and Norwegian citizenship. The Immigration Appeals Board (UNE) processes appeals concerning UDI’s decisions.

The foreign service missions and the Governor of Svalbard accept and process visa applications. In addition, the immigration sections of the police districts accept and process applications for visa extensions.

Employees of the immigration authorities may only process your personal data when it is necessary for carrying out their tasks. All staff members are bound by a duty of confidentiality regarding the information they process.

When we use external service providers, we impose equally strict requirements for security, control, and documentation to protect your personal data.

We protect the data in the registers in various ways, such as by securing our IT systems and controlling access to our buildings. Only individuals with a work-related need may access your personal data—that is, those who require access to the data to carry out their tasks.

As part of our internal control procedures, we monitor our systems, for example to detect searches carried out without a legitimate work-related reason.

UDI has a duty of confidentiality and may only disclose your personal data if authorised by law, if you have given your consent, or if you have appointed a representative (such as a lawyer or legal adviser). You may withdraw your consent at any time.

Several public authorities are entitled by law to obtain information from UDI, including the Norwegian Tax Administration, NAV, the Norwegian State Educational Loan Fund (Lånekassen), the National Population Register, and the police. We are also required to disclose information to other European countries that cooperate on border control, visa regulations, police duties, and the processing of protection (asylum) applications (i.e., countries participating in the Schengen and Dublin cooperation). In cases concerning repatriation and assisted return, we send letters to the municipality and the Norwegian State Housing Bank (Husbanken).

We also disclose certain information to international organisations and special interest organisations that assist us in immigration cases, such as Caritas, the European Technology and Training Center (ETTC), and the International Organization for Migration (IOM). Businesses and individuals that carry out tasks for UDI may also be given access to information that is necessary for their work, such as asylum reception centre operators.

UDI may also provide non-confidential information to other public agencies, businesses, and individuals where there is a legal basis for doing so. For instance, we provide information to the Labour Inspection Authority (Arbeidstilsynet) and employers regarding whether a person is legally permitted to work in Norway.

In some cases, UDI exchanges personal data with international organisations in third countries as part of our work. Such transfers are based on Article 49(1) second paragraph of the General Data Protection Regulation (GDPR). In some cases, UDI may also disclose information from individual cases for research purposes. If the research cannot be conducted without information identifying individuals, UDI may, following a specific assessment, disclose information that identify individuals.

See information about how researchers may request access to data (in Norwegian only)

Here you can read more about ongoing research and development projects (in Norwegian only)

UDI will store personal data for as long as it is necessary to carry out our statutory tasks and in accordance with our regulatory framework. As a general rule, your personal data will be deleted once there is no longer a need to store it, unless we are legally required to keep it under other legislation, such as the Archives Act.

If we are not under a legal duty to store your personal data, UDI has procedures in place for deleting such information.

If you are registered in the immigration authorities’ registers, you have the following rights pursuant to the Personal Data Act.

1. Access

You have a right to be given information about

• what specific personal data we are processing about you
• from where these were obtained
• to what purpose they are being used (tasks)
• whether they have been disclosed to others and if so, to whom

Please fill in our access request form in order to ask for this information.

2. Correcting errors

If you discover that UDI has registered incorrect, outdated or incomplete information about you, you have a right to have this corrected or updated. 

3. Right of appeal

If you believe that UDI does not process your personal data in the way required by the law, you can appeal to the Norwegian Data Protection Authority. Information about application procedures is available on the Data Protection Authority’s website.  (external website)

4. Deletion of personal data

Personal data stored in the Immigration Database is required for UDI to carry out its tasks, for scientific and historical research, for statistical purposes and for archival purposes, and as a general rule you will not be entitled to delete these, cf. Article 17 no. 3 of the General Data Protection Regulation.