Classification Guide
When handling data, you must have a clear understanding of the type of data you are dealing with and how it should be classified. This determines how and where the data should be stored. You are personally responsible for classifying the content you produce.
Below is a classification guide. Once you have classified the data correctly, the next step is to store it in the appropriate way and location.
Storage Guide for Molde University College
How to determine if your data is Green, Yellow, Red, or Black
Fields indicating approval for green, yellow, red, and black data.
Data can have different classifications:
- Open data is classified as Green.
- Restricted data is classified as Yellow.
- Confidential data is classified as Red.
- Strictly confidential data is classified as Black.
1. Open or Freely Available (Green)
Information that can or should be accessible to everyone without special access rights.
Most of the information managed by the university is open, either due to the goals and purposes of the university's activities or as a result of transparency requirements in laws, regulations, and other public administration rules. Other information does not require protection, even if it is not publicly available.
This classification is used if no harm will be caused to the institution or its partners if the information becomes known to unauthorized individuals.
Examples of such information include:
- A webpage presenting a department, course, or unit published openly on the internet.
- Study materials that are openly available but marked with a specific license and/or copyright.
- Research data that does not require protection (the researcher is responsible for this assessment).
- Teaching materials that do not require protection (the lecturer is responsible for this assessment).
Note: Even if some of this information is available to everyone, its integrity must be secured by ensuring that only individuals with the correct permissions can modify it. Additionally, while the information may be open, it does not mean it can be freely used without restrictions.
2. Restricted (Yellow)
This refers to information that is not openly available to everyone. There are no legal or regulatory requirements for the information to be open. This includes all information not classified as open, confidential, or strictly confidential.
The information requires a certain level of protection and may be accessible to both external and internal parties with controlled access rights. This classification is used if disclosure to unauthorized individuals could cause some harm to the institution or its partners. The information is relevant to or intended for a limited group of users, either within the university or at partner institutions and organizations.
Examples of such information include:
- Certain work documents.
- Information exempt from public disclosure.
- Many types of personal data.
- Grades.
- Student work.
- Exam answers.
- Unpublished research data and projects (not containing special categories of personal data).
3. Confidential (Red)
This refers to information that the university is required to restrict access to under laws, regulations, agreements, or other rules. This corresponds to the classification "Confidential" in the public Protection Instructions.
"Confidential" is used if disclosure to unauthorized individuals could cause harm to public interests, the university, individuals, or its partners.
Examples of such information include:
- Special categories of personal data (previously called "sensitive personal data"), such as ethnicity, political or religious beliefs, union membership, genetic and biometric data, sexual orientation.
- Health data.
- Information about, for example, the security of buildings and IT systems.
- Data subject to export control.
- Employee files.
4. Strictly Confidential (Black)
This category includes the same type of information as Confidential (Red), but specific considerations require further protection. Requirements for additional protection and security beyond the legal requirements must be documented in agreements or other written forms.
This corresponds to the classification "Strictly Confidential" in the public Protection Instructions.
"Strictly Confidential" is used if disclosure to unauthorized individuals could significantly harm public interests, the university, individuals, or its partners.
Placement in this category should only be done when strictly necessary and must always be done in consultation with the Vice-Rector for Research, IT Manager, and Data Protection Officer.
Examples of such information include:
- Large amounts of special categories of personal data (previously sensitive personal data).
- Research data and datasets of significant economic value.
- Health registers of a certain size.
- Information about individuals with special protection needs, such as "secret addresses."
Different Roles and Their Relevance to Classification
Information Owner
All information must have a clear and identifiable owner. It should be possible to determine who is responsible for maintaining, updating, and properly labelling the information. If no owner can be identified, the university director is responsible for the information.
The information owner is responsible for:
- Ensuring that the information is placed in the correct class according to these rules.
- Making an assessment when information changes classification.
- Ensuring that all storage, processing, and handling of information occur on approved technical solutions – see the separate [guide – link to storage guide HiMolde].
- Regularly checking compliance with any changes in requirements.
Information must always be placed in a sufficiently secure class. If in doubt about whether to choose Red or Yellow, always choose Red.
System Owner
The system owner is responsible for assessing the confidentiality, integrity, and availability classifications for the system or service. This is done through risk and vulnerability assessments.
As a rule, this conclusion, along with any prerequisites information owners and users need to know, should be made available through HiMolde's information security pages, relevant user guides, and training.
Users
All individuals handling information for HiMolde are required to classify it in accordance with relevant guidelines and the assessments made by the information owner.
IT Manager
The IT Manager can edit this guideline and establish associated routines and procedures.
Questions?
Contact personvernombud@himolde.no
Read more
Guidelines for Protection and Exchange of Personal Data and Health Research Data