1.3 Obligation to inform

When we gather personal data, we have an obligation to provide information to the data subject which must contain:

  • the identity and contact details of the controller, and where applicable, of the controller’s representative.
  • the contact details of the data protection officer (for information about the data protection officer see below)
  • the purpose as well as the legal basis of the processing
  • the recipients or categories of recipients of the personal data
  • any transfer of personal data to a third country (any country outside the EU/EES) and information about suitable safeguards applied by the recipient.

The obligation to inform applies even in cases where we do not collect the data directly from the data subject (exceptions can be made if the data subject has been informed previously, if it is practically impossible or very difficult to inform or if the transfer is required by law). This means, for example, that when a student requests a computer account from the university, we usually retrieve data from Ladok; thus we are required to inform the student that we have retrieved the information from Ladok as well as what information is retrieved when the account is requested. However, we do not need to inform that a student's study result is written into Ladok.