Data management for RDI

What is sensitive data?

Sensitive data includes different types of secret data that may form a risk of physical or economic harm.

• Sensitive personal data: special categories of personal data (Tietosuoja.fi)
• Trade secrets
• Sensitive location data: such as data concerning national defense, critical infrastructure or endangered species
• Data concerning dual-use items: definition of dual-use items (Ministry for Foreign Affairs)
• Classified information: definition of classified information (Tietotermien sanasto)

When you handle sensitive data

It is important to plan the whole data life cycle before you start processing sensitive data.

• Take data protection and ethical questions into account.
• Plan the data collection, storing, access monitoring and backup.
• Identify possible risks.
• Minimise the collection of sensitive data.

When you process personal data, read the Identifiable data and anonymisation guide and examine the Data protection checklist for RDI projects.

Data security

It is important to define who has access to sensitive data and how the access is monitored. Notice that the server administrator and technical support have access to the saved files, and because of that the files containing sensitive data need to be protected with password and/or encryption.

Protective measures in processing personal data include pseudonymisation and anonymisation. Sensitive personal data needs to be anonymised or destroyed as soon as it is no longer needed.

Data collection and transfer

Use secure tools and software when you collect or transfer sensitive data.

• Surveys: It is recommended to use E-lomake (E-form) service that stores data on Metropolia server.
• Video interviews: It is recommended to use Zoom to save the interviews on local computer instead of a cloud service.
• Send e-mails outside Metropolia as secure e-mail.
• If you save sensitive data on external storage (such as USB flash drive or external hard drive) it needs to be protected with password and/or encryption.
• Do not save sensitive data on mobile devices; use instead a recorder for interviews that contain classified or secret information.
• Do not save sensitive data on cloud services.

Storage locations

Choose the storage location for sensitive data with care. Plan also how often a backup copy is taken and where it is stored.

You can save sensitive data on Metropolia network disks according to your needs.

• Z-drive: personal network drive
• U:priv: project-specific network drive, enables collaboration inside Metropolia (request via helpdesk)
• Metroarch: Metropolia’s own sensitive data server, enables collaboration between different organisations involved in the project

CSC offers also sensitive data services for data management. SD Services comply with GDPR and include SD Connect for storing and sharing sensitive data and SD Desktop for creating a private workspace to compute sensitive data. Services are available free-of-charge to Finnish academic organisations.

Additional instructions for planning the data management

National Open Science and Research Coordination has instructions to help planning the management of confidential and personal data. The instructions include tips for best practices to consider when you need to process sensitive data.