The national data classification model shared by Finnish universities will be introduced at the University of Oulu and Oamk by the end of 2026. The model is already in use at some Finnish higher education institutions, and it will be rolled out across almost the entire university sector in Finland.

The model is based on risks related to information. Risk refers to the possibility that a threat materializes and causes harm. Information is classified based on how valuable it is to the university’s operations and what kind of impacts unauthorized use of the information could have.

The categories of the national data classification model

• Secret (1R)
  • Subcategories: Restricted Access, Personal Data or Other Information
  • The spread of information causes serious damage to the university, client, student, research participant, or employee of the university.
  • Artificial intelligence is forbidden. (Exception: the use of artificial intelligence is possible if it is considered in a separate risk assessment). Emails and attachments must be encrypted. Forwarding, printing, and copying are prohibited. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification. No distribution. Files must be protected with permissions (restricted access).
• Strictly Confidential (2A)
  • Subcategories: Personal data or other information
  • The spread of information causes damage to the university, client, student, research participant or employee of the university.
  • The information requires special security measures.
  • Artificial intelligence is forbidden. (Exception: The use of artificial intelligence is possible, if it is considered so in a separate risk assessment.) Emails and attachments must be encrypted. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification.
• Confidential (3Y)
  • Subcategories: Personal data or other information
  • The spread of information causes damage to the university, client, student, research participant or employee of the university.
  • The use of M365 Copilot AI is allowed. The use of other artificial intelligence is also possible, if this is considered in a separate risk assessment. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification.
• Internal (4G)
  • Subcategories: Personal data or other information
  • The information is intended only for the internal use of the university.
  • The use of M365 Copilot AI is allowed. The use of other artificial intelligence is also possible, if this is considered in a separate risk assessment. Anonymous links are prohibited, i.e. direct links that work for the recipient without identification. No distribution.
• Open (5W)
  • Subcategories: Personal data or other information
  • Sharing information benefits the university.
  • The use of artificial intelligence is allowed. Anonymous links are allowed.
• Private
  • Materials for personal use.
  • The use of M365 Copilot AI is disabled.

---

Alongside the data classification model, an integrated data classification tool is made available to staff in the M365 cloud service. The tool allows you to add classification labels to Office documents and Outlook emails. Based on the classification, it can also limit how information is shared, helping to prevent sensitive data from being accessed by the wrong people.

---

Data classification model: the same information in a table

Category	Subcategories	Description	Restrictions
1R Secret	Restricted Access; Personal Data; or Other Information	The spread of information causes serious damage to the university, client, student, research participant, or employee of the university.	Copilot is blocked. Emails and attachments are encrypted. (forwarding, printing and copying is blocked). Files are protected and only specified people can open them  (Restricted access). Anonymous links are blocked. Sharing outside the organisation is blocked.
2A Strictly Confidential	Personal data; Other information	The spread of information causes damage to the university, client, student, research participant or employee of the university. The information requires special security measures.	Copilot is blocked. Emails and attachments are encrypted. Anonymous links are blocked.
3Y Confidential (default category)	Personal data; Other information	The spread of information causes damage to the university, client, student, research participant or employee of the university.	Anonymous links are blocked.
4G Internal	Personal data; Other information	This information is for internal university use only and should not be shared externally, as it provides no benefit to the university.	Anonymous links are blocked. Sharing outside the organisation is blocked.
5W Open	Personal data; Other information	Sharing this information is beneficial to the university.	No restrictions.
Private	No subcategories	Private material for personal use.	Copilot is blocked.

 

 

---

« Back