When we ‘process personal data’, it means, for example, that we collect data, register them, combine them, store them or disclose them.
UDI is obliged to process your personal data in a lawful and secure way. This page describes how we process your personal data and what your rights are as a person registered in our systems.
UDI collects and uses personal data in order to carry out the following tasks:
We can normally only use your personal data for the tasks for which they were obtained. However, UDI has a duty to control and verify information we receive in immigration and citizenship cases. This means that we can use information from your previous immigration cases when considering a new case. We can also use information from another person’s case if it is necessary to consider your case.
When the immigration administration processes personal data, we do so within the framework of the Immigration Act, the Norwegian Nationality Act and pertaining regulations. UDI is authorised to process personal data in, among other regulations, the Immigration Act section 83a and the Nationality Act section 29a. UDI may therefore process personal information necessary to carry out the tasks mentioned in paragraph 1.
UDI needs to collect necessary information from you because you are applying for a residence permit or have another case under consideration. You must help to clarify your identity and have a duty to provide information that may be relevant to your case (see the Immigration Act section 83 and the Nationality Act section 29).
If necessary, UDI can also collect information from other public agencies, such as the Norwegian Tax Administration, the Norwegian Labour and Welfare Administration (NAV), the State Educational Loan Fund (Lånekassen), the Population Register, the child welfare services or the police (see the Immigration Act section 84 and the Immigration Regulations sections 17-7d to 17-7j, the Immigration Act section 29b and the Nationality Regulations sections 14-1 til 14-8). We can also collect information from publicly available sources, such as websites and social media.
UDI processes personal data that are necessary to carry out the tasks given in section 1. Which specific personal data we process about you depends on the task we need to solve. You will receive more information about this during the case processing.
There are some data that UDI will process regardless of the type of case, for example data on
UDI registers your personal data in different registers that we are responsible for keeping:
We also register certain data in European information systems:
UDI can decide cases automatically (automated processing). This means that we make a decision in a case without any caseworker assessing the information manually. The cases that UDI processes automatically will always be processed based on the regulations that apply and the personal information we have about you.
We can only process the case automatically when there are clear conditions in the regulations for whether what you have applied for should be granted or rejected. If we have to consider discretionary terms in the regulations, we can not decide the case with automated processing. If you appeal a decision that UDI has made with automatic processing, you are entitled to have a caseworker process the complaint manually.
The immigration authorities in Norway consist of several agencies that carry out different tasks. The foreign service missions and immigration sections of the various police districts accept and prepare for example applications for residence permits, while the National Police Immigration Service (PU) accepts and registers applications for protection. UDI decides cases such as applications for protection, residence permits and Norwegian citizenship. The Immigration Appeals Board (UNE) processes appeals concerning the UDI’s decisions.
The staff at the different immigration authorities use different case processing systems and through these, gain access to data that are registered about you in our databases. The staff are only to process your personal data when it is necessary to carry out their work.
We protect the data stored in the registers in different ways, for example by using firewalls and controlling who has access to our buildings. Only authorised persons are allowed to access your personal data and we control how they process personal data in our data systems.
UDI has a duty of secrecy and can only disclose your personal data if it is stated in the law that we can, or if you consent to it.
Several public agencies are entitled to collect information from UDI, such as the Norwegian Tax Administration, NAV, Lånekassen, the Population Register and the police. We also have a duty to disclose information to other countries in Europe who cooperate on national border control, visa regulations, police duties and processing of asylum applications (countries that participate in the Schengen Agreement and the Dublin Regulation).
We also disclose certain information to international organisations and special interest organisations that help us in immigration cases, such as Caritas and the International Organization for Migration (IOM). Businesses and individuals that carry out work for UDI can also be given access to information that is necessary to their work, for example those running a reception centre.
UDI can also disclose information that is not subject to a duty of secrecy to other public agencies and to businesses and individuals. For example, we disclose information to the Labour Inspection Authority and employers about whether a person has a right to work in Norway.
UDI will store your personal data as long as they are necessary to solve the tasks given in section 1. After that, your personal data can be transferred to the National Archives (see the Archives Act).
UDI is the data controller. This means that we are responsible for how your personal data are processed in UDI and at the asylum reception centre in connection with the tasks named in section 1. We are also responsible for the personal data filing systems UDB, the register of foreign nationals and the parts of EURODAC and VIS that concern Norway.
If you are registered in the immigration authorities’ registers, you have the following rights pursuant to the Personal Data Act.
You have a right to be given information about
Please fill in our access request form in order to ask for this information.
If you discover that UDI has registered incorrect, outdated or incomplete information about you, you have a right to have this corrected or updated.
If you believe that UDI does not process your personal data in the way required by the law, you can appeal to the Norwegian Data Protection Authority. Information about application procedures is available on the Data Protection Authority’s website. (external website)
Personal data stored in the Immigration Database is required for UDI to carry out its tasks, for scientific and historical research, for statistical purposes and for archival purposes, and as a general rule you will not be entitled to delete these, cf. privacy regulation, article 17, no. 3.
UDI will in some cases provide information from individual cases for research purposes. The personal information will in these cases be anonymised before they are handed out to researchers. If the research cannot be completed without information that identify individuals, UDI may make a specific assessment to provide information that identify individuals.
See information about how researchers can get access to data (in Norwegian only)
Here you can read more about ongoing research and development projects (in Norwegian only)