Where can I store information?

Information is stored in the information systems designated as their storage locations. Information is handled on paper only when necessary.

Data classification table describes how information is classified and handled at HAMK. Digital Services may grant exceptions if there is a justified reason and the risks have been assessed.

Classification

HAMK’s information classification is based on the joint national information classification model for higher education institutions. Information is classified to ensure it is handled appropriately. Different types of information must be handled in different ways. A common classification model facilitates cooperation across organizational boundaries. The classification is:

• Secret (1R)
• Restricted Confidential (2A)
• Confidential (3Y)
• Internal (4G)
• Open (5W)
• Private

Secret / Secret (1R)

Information may only be viewed and processed by specifically authorized and trained persons. Disclosure would cause serious harm to the institution, customer, student, research subject, or employee.

Examples of personal data:

• Special categories of personal data under the GDPR
• Health-related data
• Personal data related to criminal convictions where permitted by law

Examples of other data:

• Security-related information
• Certain security arrangements
• Contractually confidential material
• Classified government information
• Detailed technical documentation of information systems and access control

Restricted Confidential / Strictly confidential (2A)

Disclosure would cause harm and requires special protective measures. Access is limited to persons who need the information for their duties.

Examples of personal data:

• Personal identity number
• Data concerning a minor
• Payment and credit card details
• Applicant and student examination performance
• Protected contact details
• Verbal assessments of a student’s personal characteristics

Examples of other data:

• Staff-only documentation
• Research plans
• Extensive or nationally long-term research datasets
• Third-party trade secrets
• NDA-protected material

Confidential / Confidential (3Y)

Disclosure would cause harm. Information may be accessed by members of the relevant group, including students in research projects.

Examples of personal data:

• Basic personal details (name, address, phone number, email)
• User identifiers
• Ongoing studies
• Data that can identify a person when combined with other information
• Identifying IP addresses
• Basic employment information

Examples of other data:

• Draft or preparatory documents
• Information received from third parties without specific handling instructions

This is the default classification at HAMK.

Internal / Internal (4G)

Information intended for internal use only. Sharing outside HAMK provides no benefit.

Examples:

• Internal announcements
• Internally produced or licensed learning materials
• Guidelines and memoranda

Open / Open (5W)

Sharing the information is beneficial to HAMK. There are no access restrictions, but copyright must be respected.

Examples:

• Publications
• Public documents
• Public announcements
• Public websites

Private

Private material is intended for private use only and not for work purposes. The individual defines access and handling rights.

Classification color codes

• Secret (1R) – Red
• Restricted Confidential (2A) – Amber
• Confidential (3Y) – Yellow
• Internal (4G) – Green
• Open (5W) – White

Why is correct classification important?

Correct classification improves information management. Information is easier to find and share. Classification protects personal data, confidentiality, and ensures legal compliance. If information falls between two classes, the stricter classification should be chosen.

Future plans: Classification in Microsoft products

HAMK will gradually implement information classification in Microsoft Office, Teams, and email. The person handling the information will select the classification. Classification will guide the use of AI, email encryption, and link sharing. Further instructions will be provided later.