Privacy and data protection commitee for research

Data Access Committee (DAC)

The Data Access Committee (DAC) reviews, assesses and approves the data collection and protection measures of all research project associated with Helse Møre og Romsdal hospital trust (HMR). All research projects require approval from DAC before startup.


Klikk her for informasjon på norsk

AC was established as a means for upholding the Health Research Act's requirement of internal control (§ 4)​ and the guidelines of Article 30 of the General Data Protection Regulation (GDPR).

The requirement of internal control applies to all types of research projects which aim to publish their results in academic journals. Such projects may range from innovation projects, quality assurance projects, and bachelor's and master's theses. This requirement also applies to projects with external project leaders that seek to use data from our hospitals.

You must submit an approval application to DAC in order to have your project assessed and approved. Please read the following information on how to submit your application to DAC.

You need to attach the following that is relevant to your project:

  • ​Study protocol / project description
  • Your REK application and REK approval (or application to and approval from SIKT)
  • Project approval from your Head of Clinic (approval via e-mail is sufficient)
  • Information and consent forms
  • Collaboration and data processing agreements
  • DPIA or ROS analysis
  • If your project contain clinical trials involving medical devices and/or medicines, you must attach the following:​
    • ​Application and approval from The Norwegian Medicines Agency (Legemiddelverket)​
    • Your trial monitoring agreement​​ (mandatory by law)
Master's theses​​:
Any of the above that applies to your project, including the following:​

  • Application to and approval from SIKT (previously known as Norwegian Centre for Research Data/NSD). DAC may still review your application even if you have not received approval from SIKT.

​All approval applications need to be submitted to DAC. The committee usually meets every third week to review applications. Applications need to be submitted half a week in advance to the next scheduled meeting (see application deadlines below).

Use the DAC application form below (requires a Helse-Midt network connection). If you're an external applicant, please contact the Division of Research and Development ​at​.

Click here to view the DAC application form.
If you wish to make changes to your application, click here.​

N.B: All documents need to be included in your application before it may be reviewed by DAC.

​If you are unable to open the application form, you may be using an unauthorized Microsoft account. Authorization is required to access our intranet. Contact HEMIT at +47​03612 for assistance.​

Relevant guidelines by HMR and other statutes:

The application deadlines are not absolute. Please contact​

Meeting schedule and application deadlines 2023
​DeadlinesAU-DAC meetingsDAC meetings
December 9th (2022)
December 13th (2022)
December 20th (2022)
January 6th
January 10th
January 17th
January 27th
January 31st
Februrary 7th
February 17th
February 21st
February 28th
March 10th
March 14th
March 21st
March 31th
April 4th
April 11th
April 21st
April 25th
Mai 2nd
May 12th
May 16th
May 23rd
June 2nd
June 6th
June 13th
June 23rd
June 27th
July 4th

Holiday leave, 5th of July - August 3rd

August 4th
August 8th
August 15th
August 25th
August 29th
September 5th
September 15th
​September 19th
September 26th
October 6th
October 10th
October 17th
October 27th
October 31st
November 7th
​November 17th
November 21st
November 28th
December 8th
December 12th
December 19th

Head of Committee
Anne-Sofie Furberg, Head of Research and Development

Jo-Åsmund Lund, oncologist/MD/PhD/associate professor
Tone S. Fuglset, research advisor/PhD
Katarina Mølsæter, monitor/advisor
Jan Rino Austdal, lawyer/data protection official
Therese M. Istad, advisor (Research and Development)
Lennart Johansson, data protection advisor for research, Helse Midt-Norge
Vibeke D. Valderhaug, research advisor​

Other associates:
Tor Åge Myklebust, PhD, statistician, researcher
Linda Kvernald, IT advisor, PAS
Geir Vikestrand, IT advisor, patient journal

​Therese M. Istad, advisor (Research and Development)
​Tone S. Fuglset, PhD, research advisor
Vibeke D. Valderhaug, PhD, research advisor

DAC was established as a means for upholding the Health Research Act's requirement of internal control (§ 4)​ and the guidelines of Article 30th of the General Data Protection Regulation (GDPR).

All medical and healthcare research is required to abide by the guidelines of the Health Research Act. Both project leaders and associated organizations are responsible for upholding these regulations.​

The requirement of internal control applies to all types of research projects, e.g. internal projects at HMR, multicenter studies, and external projects that seeks to use data/patient information from HMR.

​​​​​What does DAC review?

​DAC reviews and approves a project's privacy and data protection measures on behalf of the HMR administration.

DAC does not usually review the scientific quality and value of research projects. The project leader is responsible for assuring that the project is of high scientific quality, feasibility and value. This needs to be formulated in a clear and concise manner when applying for approval from DAC.​

DAC may nonetheless review the aforementioned and similar areas (e.g, the project's ethical and scientific aspects) that is related to the quality and value of the research project. DAC may, based on this, propose changes to the application before the project can be approved.

​DAC competence

​The DAC members have broad knowledge of topics related to privacy and data protection and conducting research projects at the theoretical and practical level.

​​​​DAC shall

  • ​​​assure privacy and data protection in research
    • ​by ensuring that all research projects are formally approved and in accordance with the privacy and data protection guidelines.
    • when retrieving sensitive information from patient journals and quality registries.
    • when storing and retrieving biological materials.
  • ​assure privacy and data protection in medical and healthcare research, including
    • ​quality assurance projects.
    • innovation projects.
    • research projects.

DAC may also assess:

  • the overall quality and use of the project, including...
    • ​its ​ethical, professional and scientific aspects​
    • the project leader's professional and scientific competence
DAC is not required to assess:

  • continuous internal quality assurance in relation to § 26 of The Health Personnel Act that is recorded in accordance to Article 30 of GDPR. This does not require approval from DAC.
​DAC arranges meetings approx. every third week. All applications need to be submitted half a week in advance to the scheduled meeting. 

All relevant documents need to be attached to the application before it may be reviewed by DAC. Each meeting typically assesses five applications but the number may vary depending on how comprehensive each application is.

​Decisions and complaints on decisions
​Decisions by DAC is done on behalf of HMR. Decisions that reject an application need to be properly reasoned. The applicant may appeal the decision within three weeks after the decision has been given.

All appeals are submitted to DAC, which arranges a new review of the application in question. The decision may either be maintained or changed depending on the final verdict by DAC.

If the decision is still maintained: DAC prepares and forwards the appeal case​ to the Director of Medical Strategy and Development, who functions as the main appellate instance. The Director's decision is final. The regulations of the Public Administration Act​ apply.​​

​Please contact DAC at

Sist oppdatert 25.08.2023