The national data classification model shared by Finnish universities will be introduced at the University of Oulu and Oamk by the end of 2026. The model is already in use at some Finnish higher education institutions, and it will be rolled out across almost the entire university sector in Finland. The model is risk‑based: information is classified according to how important it is to the institution and what impact unauthorized use could have.

The categories of the national data classification model

• Secret (1R)
  • Subcategories: Restricted Access, Personal Data or Other Information
  • The spread of information causes serious damage to the university, client, student, research participant, or employee of the universtiy.
  • Artificial intelligence is forbidden. (Exception: the use of artificial intelligence is possible if it is considered in a separate risk assessment). Emails and attachments must be encrypted. Forwarding, printing, and copying are prohibited. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification. No distribution. Files must be protected with permissions (restricted access).
• Strictly Confidential (2A)
  • Subcategories: Personal data or other information
  • The spread of information causes damage to the university, client, student, research participant or employee of the university.
  • The information requires special security measures.
  • Artificial intelligence is forbidden. (Exception: The use of artificial intelligence is possible, if it is considered so in a separate risk assessment.) Emails and attachments must be encrypted. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification.
• Confidential (3Y)
  • Subcategories: Personal data or other information
  • The spread of information causes damage to the university, client, student, research participant or employee of the university.
  • The use of M365 Copilot AI is allowed. The use of other artificial intelligence is also possible, if this is considered in a separate risk assessment. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification.
• Internal (4G)
  • Subcategories: Personal data or other information
  • The information is intended only for the internal use of the university.
  • The use of M365 Copilot AI is allowed. The use of other artificial intelligence is also possible, if this is considered in a separate risk assessment. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification. No distribution.
• Open (5W)
  • Subcategories: Personal data or other information
  • Sharing information benefits the university.
  • The use of artificial intelligence is allowed. Anonymous links are allowed.
• Private
  • Materials for personal use.

---

Alongside the data classification model, an integrated data classification tool is made available to staff in the M365 cloud service. The tool allows you to add classification labels to Office documents and Outlook emails. Based on the classification, it can also limit how information is shared, helping to prevent sensitive data from being accessed by the wrong people.

---

« Back