Processing especially confidential information
- Objectives of information protection
- Methods for protecting information
- File sharing
- Secure working methods
Highly confidential information refers to information classes 1R and 2A in the data classification scheme (see the instructions on the page Data classification and handling). The secure processing of such information requires special measures at different stages. First, you must store the information in a way that safeguards its confidentiality so that it cannot fall into unauthorised hands. Another important stage is sharing information with collaborators. The third stage is processing the information, which you must do using approved tools and methods.
Objectives of information protection
Protect all your files against unauthorised access by external parties. This is your obligation under data protection regulations and, more generally, part of your responsibility to protect confidential information from external parties. You can find additional guidance on the pages Data protection at Tampere Universities and Information security and IT policies.
Protect all your files against inappropriate access and use by AI tools. AI tools can read all files stored in Teams and OneDrive to which you have access. If an AI tool can access a file containing information that is too confidential, that confidential content may end up in AI-generated responses. As a result, you may unintentionally cause a personal data breach or other harm. If an AI tool can access a file containing outdated or otherwise inaccurate information, that information may also appear in AI-generated responses. As a result, you may unintentionally distribute outdated or incorrect information. For more information, see the pages AI and copyright and Artificial intelligence.
Methods for protecting information
Review all your files and determine the data classification of each one according to the instructions on the page Data classification and handling.
Share and process information using secure working methods. Guidance is provided later on this page.
Follow the instructions on this page both for files that you create and process yourself and for files created and processed as part of projects and other collaborative activities. In research projects, responsibility for all information processing lies not only with each user but also with the principal investigator (PI).
Data classification in Office applications
Set the data classification of all files created with Office applications (Word, PowerPoint, Excel and others) to the correct level using the Sensitivity menu. The default classification is “3Y Confidential”, but this may not be the appropriate classification for the file. Applying an data classification to a file restricts its sharing and AI access to its content. However, data classification does not save the file in encrypted form. Therefore, you must encrypt all 1R files and preferably also 2A files with a dedicated encryption program. The protection measures associated with data classification work when the file is stored in OneDrive or Teams.
File encryption
Encrypt files with a dedicated encryption program whenever you want to ensure that only specific people, and no one or nothing else, can access them. Encrypt at least all 1R files and preferably also 2A files using a dedicated encryption program. Use one of our recommended encryption programs and a long passphrase. Instructions are available on the File encryption page. For files that require editing, we recommend using VeraCrypt or Cryptomator. Other files are easiest to encrypt with 7-Zip. You can create an encrypted vault or volume with an encryption program in any storage location and copy it anywhere while maintaining the same level of security (USB devices require additional protection; see the instructions on the above-mentioned page).
Exceptions
If you can carry out your research project work in CSC’s SD Desktop or CSC’s ePouta, files stored there are protected sufficiently through other measures and do not require classification using Microsoft Office sensitivity labels or encryption with a dedicated program. You can find more information about both services on the CSC page Services for sensitive data. For further information and help with setting up these services, contact the IT Helpdesk.
Tampere University is implementing its own secure data processing system, which is expected to be completed in spring 2027. We will announce its completion on the intranet.
File sharing
After storing highly confidential files securely, you may also need to share them within Tampere Universities or with external partners. For instructions, see the page Sharing files with partners.
Secure working methods
In addition to the protection measures described above, processing highly confidential information requires special working methods. The following instructions cover some common processing activities. If you cannot find the information you need, contact the IT Helpdesk.
- Guidance on collecting research data is available on the page Collecting research data.
- Guidance on secure video meetings is available on the page Information security guidelines for setting up remote meetings and interviews using Teams or Zoom.
- Guidance on transcription is available on the page Interview data.
- Unfortunately, no computer-based tools are currently available for translating 1R-classified material. The only secure option is to order translation as a service according to the instructions on the page Translation and language services. If you send material by email, encrypt the message according to the instructions on the page Email encryption.
IT Helpdesk
0294 520 500
it-helpdesk [at] tuni.fi (it-helpdesk[at]tuni[dot]fi)
helpdesk.tuni.fi