Storage Guide for students
When working with information or data, it is important to know how the information should be handled, shared, and stored securely. To make this easier, we divide information into four categories based on its sensitivity: green, yellow, red, and black. Each category has specific requirements for how the information should be managed and protected.
The different categories
🟢Public dataCan be shared and published freely. | 🟡Internal dataOnly for people who need access. - Limited access | 🔴Confidential dataRequires a high level of protection. | ⚫Strictly confidential dataVery high need for protection. |
|---|
What counts as:
🟢 Public data
Information that can be published openly without causing harm to individuals, the university, or partners.
- Course descriptions
- Published articles
- Public websites
- Open teaching materials
Rule of thumb:
Can the information be published openly on the internet without logging in? Then it is normally public.
🟡 Internal data
Information that is not publicly available, but would normally not cause serious harm if it got out.
- Group documents
- Student lists
- Project notes
- Course files
- Contact lists
Rule of thumb:
If the information is meant for staff or students, but not the public, it is usually internal.
🔴 Confidential data
Information that needs a high level of protection because unauthorized access or loss could harm individuals or the business.
- Health information
- Special categories of personal data
- Compilation of large amounts of personal data
- Certain research data
Rule of thumb:
If the information could cause significant harm to individuals or the institution, it should be treated as confidential.
⚫ Strictly confidential data
Information with a very high need for protection where unauthorized access can have serious consequences.
- Large amounts of confidential data
- Export-controlled information
- High-risk research
- Security-critical data
- Information under special requirements
Rule of thumb:
If the consequences of a data breach could be very serious, the information should be treated as strictly confidential.
How to categorize files in M365
Sensitivity labels help you make sure that only those who need access can see the content of your file, especially if files contain information about you or other people that shouldn't be shared.
Use the labels by:
- Opening the document in M365 (Word, Excel, PowerPoint).
- Go to the 'Sensitivity' option at the top right of the toolbar.
- Choose the right label from the categories: Public, Archive, Internal, or Confidential
Where do I actually store it?
🟢Public dataGreen category | 🟡Internal dataYellow category | 🔴Confidential dataRed category | ⚫Strictly confidential dataBlack category |
|---|---|---|---|
| Microsoft Onedrive ☁️ Your personal workspace, connected to your UiA account. | Microsoft Onedrive ☁️ Your personal workspace, connected to your UiA account. | Microsoft Teams/Sharepoint/Onedrive with limited access 👥📁☁️ | TSD – Service for sensitive data |
| Microsoft Teams 👥 Collaboration in groups, projects and student associations. | Microsoft Teams 👥 Collaboration in groups, projects and student associations. | Secure channel in ServiceNow | Nettskjema integrated with TSD During the collection of data to be delivered directly into a secure TSD project. |
| Microsoft Sharepoint 📁 Shared areas for groups that need common access. | Microsoft Sharepoint 📁 Shared areas for groups that need common access. | Nettskjema | Never use private equipment or devices with internet connection for recording or temporarily storing this type of data. |
| Open channels for teaching and learning Such as public video platforms and published educational resources. | Share only with those who actually need access, and use your UiA account, not private storage. |
| |
No special requirements for access control, but the content must still be correct and approved for publication. |
Examples
Student assignment
- You create the project
The group creates documents, presentations, and meeting notes.
→ - Assess the content
The information is not public, but does not contain sensitive personal data.
→ - Classification
🟡 Internal data
→ - Save properly
Teams, OneDrive, or SharePoint 👥☁️📁
Research project
- You conduct interviews
The project collects health information about individuals.
→ - Assess the content
The data can be linked to identifiable individuals.
→ - Classification
🔴 Confidential data
→ - Store correctly
Teams, OneDrive, or SharePoint with access control and sensitivity label 👥☁️📁
Can be stored for up to 1 year.
Read more about sensitivity labels
Student Association
- You manage members
The student association stores names and email addresses.
→ - Review the content
This is personal information, but not sensitive information.
→ - Classification
🟡 Internal data
→ - Store properly
Teams, SharePoint, or another approved solution 👥📁
Common pitfalls
The boundary between public and internal is where most students make mistakes, not the boundary against red or black. Here are some examples of things that feel harmless but should not be published openly.
Group photo from a field trip
✖ Don’t post publicly with everyone’s full names
✔ Is 🟡internal data – share in Teams or with everyone’s consent
A photo with names can identify individuals, so it’s no longer neutral, public information.
Practice report with observations
✖ Shared in an open student group online
✔ Is 🟡internal or 🔴confidential data, depending on the content
Practice reports often contain information about people other than yourself.
Research Data
✖ Don't save interview recordings on a private USB drive or personal cloud storage
✔ Are 🔴confidential data - use approved storage solutions
Research materials often contain personal information or other sensitive information
Presentation from project work
✖ Uploading to a public sharing service 'for convenience'
✔ Is 🟡internal data, unless it is approved for publication
Just because something is finished and tidy doesn't mean it is automatically meant for the public.
Important to remember
- Internal, confidential, and strictly confidential data should only be stored in UiA’s approved solutions
- Do not keep internal, confidential, or strictly confidential data on an unencrypted USB drive
- Do not share or provide internal, confidential, or strictly confidential data in chat and messaging apps that are not approved by UiA
- Do not leave printouts containing internal, confidential, or strictly confidential data lying around freely
What happens if I have saved something incorrectly?
It certainly happens from time to time, and the most important thing is that you address it quickly. This is the usual procedure:
- Move the information to the correct system as soon as you discover the error.
- Report the discrepancy so that UiA has an overview and can follow up if others are affected.
- IT or the data protection contact will assess whether further measures are needed.
Reporting an error is not the same as being 'caught' for something. This is how errors are corrected and how procedures are improved for everyone.
Report an issue - data protection and information security
Can I keep my data when I finish at UiA?
When you leave as a student, your student account will be closed and your data deleted. Remember to save any files you wish to keep before the account is terminated. This only applies to files that you are allowed to take with you, such as your own notes and public data.
Correct use of data in AI tools
See which data you can process in AI tools