4.2.3 Comment on step 3

Step 3 - Register your processing

Any processing of personal data must be recorded in the university’s records of personal data processing. You can find the registry at: Anmälan om personuppgiftsbehandling_thesis and fill in the purpose of the treatment, what types of information you intend to collect and process, your contact details, how long the data will be saved (if possible), if any third party will participate in the work on personal data and how the information will be protected. After logging in to the records, there are help texts and explanations for each type of information to be entered. The records must not contain any of the collected personal data, only a list of what is collected and processed so that the university has control over what processing is in progress. The university is the controller, and as such, formally responsible for the personal data being processed throughout the university, and this also applies to degree projects.

Registration of processing

As mentioned above, the university is responsible for the student's degree assignments and has established a record of personal data processing activities conducted within the university. Each treatment must be registered, and this means that the student who intends to use personal data for his or her degree project must also register the processing in the records. In short, you log in to the website of the records and fill in information about:

  • the purpose of the treatment,
  • the contact person for the processing (the student),
  • a description of the categories of data collected,
  • how long the data will be processed (if it is possible to specify) and,
  • if possible, a description of the technical and organizational protection measures.

In addition, some other pieces of information should also be included in the records, but these are common to all processing and already recorded. After logging in to the records, help texts are available which explain what to type into the different fields. The registration is not complicated and does not contain any data from the processing itself, only information about the processing, what it is about, and who is doing it. The login is done using the personal computer identity and anyone who has an account at the university can also register their personal data processing here. Anyone who works in an existing treatment does not need to register anything. It is only those who own a processing that do (for example, a student who decides to work with personal data for his/her degree). The registration is a requirement under the General Data Protection Regulation. It is important to the university, as the controller, to have an overview of the processing that takes place and, if necessary, be able to contact the right person.