The UDI collects and uses personal data in order to carry out the following tasks:

• process cases concerning visas, residence permits, protection, exclusion, travel documents, citizenship, rejection, expulsion, and assisted return
• control and verify information, for example clarify someone’s identity, age and family relationships
• revoke permits, such as residence permits or visas
• offer asylum seekers a place to live and provide financial support to people living in asylum reception centres
• exercise care responsibility for unaccompanied minor asylum seekers between the ages of 15 and 18
• make arrangements for people with follow-up needs at the asylum reception centre where they live and while their cases are processed
• report on our case processing, for example to the government and the ministries
• for necessary testing of new IT systems

We can normally only use your personal data for the tasks for which they were obtained. However, the UDI has a duty to control and verify information we receive in immigration and citizenship cases. This means that we can use information from your previous immigration cases when considering a new case. We can also use information from another person’s case if it is necessary to consider your case. 

When the immigration administration processes personal data, we do so within the framework of the Immigration Act, the Norwegian Nationality Act and pertaining regulations. The UDI has its own powers to process personal data in, among other regulations, the Immigration Act section 83a and the Nationality Act section 29a. The UDI may therefore process personal information necessary to carry out the tasks mentioned in paragraph 1.

The UDI needs to collect necessary information from you because you are applying for a residence permit or have another case under consideration. You must help to clarify your identity and have a duty to provide information that may be relevant to your case (see the Immigration Act section 83 and the Nationality Act section 29).

If necessary, the UDI can also collect information from other public agencies, such as the Norwegian Tax Administration, the Norwegian Labour and Welfare Administration (NAV), the State Educational Loan Fund (Lånekassen), the Population Register, the child welfare services or the police (see the Immigration Act section 84 and the Immigration Regulations sections 17-7d to 17-7j, the Immigration Act section 29b and the Nationality Regulations sections 14-1 til 14-8). We can also collect information from publicly available sources, such as websites and social media.

The UDI processes personal data that are necessary to carry out the tasks given in section 1. Which specific personal data we process about you depends on the task we need to solve. You will receive more information about this during the case processing. 

There are some data that the UDI will process regardless of the type of case, for example data on

• identity (for example name, date of birth, place of birth, gender, nationality, passport number)
• biometry (facial photograph and finger prints)
• place of residence and contact information (for example postal address, registered address, email address and phone number)
• relationship to others (for example family, host family, employer, place of study)
• financial situation (for example income, financial support from the public services, assets)
• the immigration case (for example the status of the case, information about what has happened in the case and the grounds for being granted a residence permit)

The UDI registers your personal data in different registers that we are responsible for keeping:

• The database of foreign nationals (UDB) is the main personal data filing system of the immigration authorities. All information in immigration and citizenship cases is registered and stored in UDB. Foreign nationals who are registered are given a unique identification number (DUF number). There are also Norwegian nationals registered in UDB, such as family members, host families and employers.
• The Register of Foreign Nationals (Utlendingsregisteret) is a register of biometric data containing fingerprints and facial photographs of people from countries outside the EU and EEA area (see Section 100 of the Immigration Act).

We also register certain data in European information systems:

• EURODAC is a register of biometric data containing fingerprints and identity data of people from countries outside the EU and EEA area who are applying for protection or who have unlawfully crossed a national border.
• The Visa Information System (VIS) is an information system containing personal data, facial photographs and fingerprints of people from countries outside the EU and EEA area who are applying for a visitor’s visa.
• The Schengen Information System (SIS) is an information system containing information on people who are not permitted to enter and stay in the EU/EEA area, or who are wanted in connection with criminal acts. Kripos is responsible for the part of SIS that concerns Norway. 

The UDI can decide cases automatically (automated processing). This means that we make a decision in a case without any caseworker assessing the information manually. The cases that the UDI processes automatically will always be processed based on the regulations that apply and the personal information we have about you.

We can only process the case automatically when there are clear conditions in the regulations for whether what you have applied for should be granted or rejected. If we have to consider discretionary terms in the regulations, we can not decide the case with automated processing. If you appeal a decision that the UDI has made with automatic processing, you are entitled to have a caseworker process the complaint manually.

The immigration authorities in Norway consist of several agencies that carry out different tasks. The foreign service missions and immigration sections of the various police districts accept and prepare for example applications for residence permits, while the National Police Immigration Service (PU) accepts and registers applications for protection. The UDI decides cases such as applications for protection, residence permits and Norwegian citizenship. The Immigration Appeals Board (UNE) processes appeals concerning the UDI’s decisions. 

The staff at the different immigration authorities use different case processing systems and through these, gain access to data that are registered about you in our databases. The staff are only to process your personal data when it is necessary to carry out their work.

We protect the data stored in the registers in different ways, for example by using firewalls and controlling who has access to our buildings. Only authorised persons are allowed to access your personal data and we control how they process personal data in our data systems. 

The UDI has a duty of secrecy and can only disclose your personal data if it is stated in the law that we can, or if you consent to it.

Several public agencies are entitled to collect information from the UDI, such as the Norwegian Tax Administration, NAV, Lånekassen, the Population Register and the police. We also have a duty to disclose information to other countries in Europe that cooperate on control of national borders, visa regulations, police duties and processing of asylum applications (countries that participate in the Schengen Agreement and the Dublin Regulation).

We also disclose certain information to international organisations and special interest organisations that help us in immigration cases, such as the Norwegian Organisation for Asylum Seekers (NOAS) and the International Organization for Migration (IOM). Businesses and individuals that carry out work for the UDI can also be given access to information that is necessary to their work, for example those running a reception centre.

The UDI can also disclose information that is not subject to a duty of secrecy to other public agencies and to businesses and individuals. For example, we disclose information to the Labour Inspection Authority and employers about whether a person has a right to work in Norway. 

The UDI will store your personal data as long as they are necessary to solve the tasks given in section 1. After that, your personal data can be transferred to the National Archives (see the Archives Act).

The UDI is the data controller. This means that we are responsible for how your personal data are processed in the UDI and at the asylum reception centre in connection with the tasks named in section 1. We are also responsible for the personal data filing systems UDB, the register of foreign nationals and the parts of EURODAC and VIS that concern Norway. 

If you are registered in the immigration authorities’ registers, you have the following rights pursuant to the Personal Data Act.

Access

You have a right to be given information about

• what specific personal data we are processing about you
• from where these were obtained
• to what purpose they are being used (tasks)
• whether they have been disclosed to others and if so, to whom

Please fill in our access request form in order to ask for this information.

Correcting errors

If you discover that the UDI has registered incorrect, outdated or incomplete information about you, you have a right to have this corrected or updated. 

Right of appeal

If you believe that the UDI does not process your personal data in the way required by the law, you can appeal to the Norwegian Data Protection Authority. Information about application procedures is available on the Data Protection Authority’s website.  (external website)

Deletion of personal data

Personal data stored in the Immigration Database is required for the UDI to carry out its tasks, for scientific and historical research, for statistical purposes and for archival purposes, and as a general rule you will not be entitled to delete these, cf. privacy regulation, article 17, no. 3.

UDI will in some cases provide information from individual cases for research purposes. The personal information will in these cases be anonymised before they are handed out to researchers. If the research cannot be completed without information that identify individuals, UDI may make a specific assessment to provide information that identify individuals.

See information about how researchers can get access to data (in Norwegian only)