We will introduce the Data Classification tool for all staff on 15 November 2026. The aim of this change is to support the appropriate handling of information, improve information security, and strengthen information governance across higher education institutions. Further information and all related guidance are available on the ICT instructions website (ict.oulu.fi).
What will change in a researcher’s daily work?
Researchers’ day-to-day work in Teams, OneDrive and Microsoft Office applications will remain largely unchanged.
Going forward, file owners and email senders will assign the appropriate sensitivity label to files and emails based on their content. This helps ensure that research data, unpublished research findings and other confidential information are handled securely and protected at the appropriate level.
Key points requiring special attention
Researchers often work with information that requires careful protection, such as:
- datasets containing personal data
- unpublished or preliminary research results
- copyright-protected material that must not be processed using AI tools
- non-disclosure agreements (NDAs)
- information provided by companies, including documents containing trade secrets
- material related to patent applications
If such information is processed or stored within the Microsoft 365 environment, it must be classified labeled) appropriately.
As a researcher, you are best placed to understand what types of information are collected and processed within your project. Microsoft 365 services may be used to support research activities when this is permitted by the nature of the research data, applicable data protection requirements, and the specific conditions of the research project.
Particularly sensitive research data should be stored using the University’s designated secure solutions and in accordance with the guidance provided for the project. Please also refer to the instructions concerning storing and further use of research data containing personal data. (Patio. To open this page, you must log in.)
How does data classification benefit researchers?
Data classification helps protect:
- research data requiring enhanced protection
- special categories of personal data
- unpublished research findings
- confidential information related to research collaborations
- information assets from unauthorised AI processing
By applying the appropriate protection level to a file based on its contents, you reduce the risk of information being shared or processed more widely than intended.
Can I still collaborate with external research partners in Teams?
Yes.
Data classification does not prevent research collaboration or the sharing of files with research partners. However, sensitivity labels 1R and 2A impose restrictions on sharing and help ensure that information is disclosed only to the intended audience.
Where necessary, the sensitivity label applied to a Teams workspace can also be used to restrict access for external participants.
Which files are affected by data classification?
The Data Classification model applies to all documents. However, the sensitivity labeling tool is available only within the Microsoft 365 environment.
Data classification (sensitivity labeling) does not apply only to newly created documents.
Existing files should also be reviewed and labeled according to their contents. This is particularly important in advance of the wider deployment of Microsoft 365 Copilot, as Copilot may access files that fall within a user’s permissions unless access has been restricted through the appropriate sensitivity label.
Please note that Copilot may use a file you have shared with someone who has access to Copilot if the file is labeled as 5W, 4G or 3Y.
Files labeled as 1R, 2A and Private are excluded from Copilot processing.
Be aware of file version history
A file’s version history may contain earlier versions that include confidential or restricted information. Anyone with editing rights to a file can view previous versions through version history.
Please note that Microsoft 365 Copilot does not use earlier file versions.
If you create a version of a 2A or 1R document that no longer contains higher-classification information, save it as a new file and assign the appropriate lower sensitivity label.
This ensures that information subject to the higher classification remains within the original document and is not exposed through the version history of the new file.
This is particularly important when a file is shared with a wider audience than the original document.
What about research publications?
For research publications, data classification is based on the content of the material.
Draft publications and manuscripts
Draft publications and unpublished manuscripts should be classified (labeled) according to the nature of the information they contain.
For example:
- unpublished manuscripts may contain valuable research findings
- premature disclosure of research data or results may cause significant issues
Published research outputs
Published research outputs are usually public and generally do not require additional protection measures.
Please note that personal data may appear in any classification category. The appropriate classification depends on the nature of the personal data involved. Classification is based on risk assessment.
See also
Questions?
If you have any questions about data classification in general, or questions about sensitivity labeling in M365, please contact the Data Classification Project Team at:
Your message will be routed through the Service Desk, and the project team will respond by email.