Data storage at HVL

Available to everyone

Information that can not only, but also should be available to everyone - without restrictions.

This may be based on HVL's societal mission or mandated through laws, such as the Freedom of Information Act or regulations within the relevant field. Much of HVL's information falls under this category of open [green] information.

Even though the information is freely accessible, it is important to ensure its accuracy. Therefore, we have a responsibility for the integrity of our open information. This means that it should always be up to date and that only authorized individuals can make changes. There may also be guidelines regarding the use and copying of data that must be followed (copyright and licensing). For HVL, being a responsible public institution, it is crucial to adhere to such guidelines.

Examples of open [green] information include:

• information about study programs and research activities
• open publications
• study and research materials not limited by copyright.

Where can I store such information? Storage guide.

Accessible to those who need it for their work

Information that is relevant to or targeted at a specific group within HVL or named external collaborators who require access.

If such information goes astray, it can cause limited harm to individuals, the institution, or the collaborators.

The integrity of the information should be protected against alteration, deletion, and damage in the same way as open information. Additionally, it should be safeguarded against unauthorized access and dissemination.

Security measures should be implemented by controlling access through assigning read and write permissions to named individuals or groups. The owner should review access rights at least once a year.

Most of the information processed within HVL's administration will be internal (yellow).

Examples of internal (yellow) information include:

• Internal documents relevant to a specific group
• Documents that are "not publicly accessible" but not classified as "confidential" or "strictly confidential"
• Information in research, education, financial, and administrative systems
• Personal data, excluding social security numbers and special categories of personal data

Where can I store such information? Storage guidelines.

Information subject to restricted access.

This refers to information where access limitations are imposed.

Confidential information refers to information that is inherently sensitive or that HVL is required to restrict access to by law, regulations, agreements, rules, or other regulatory frameworks.

"Confidential" corresponds to the classification level used in the Protection Instruction. It is used for information that, if disclosed to unauthorized individuals, would cause harm to public interests, the institution, individuals, or collaborating parties.

As a general rule, this information should only be stored in dedicated systems designed for the purpose and based on the owner's written assessment of the need, legal basis, and risks involved.

Furthermore, access to this information should be controlled by granting read and write permissions to authorized individuals or groups. Authorization for access is based on specific assigned tasks or approved research purposes.

Examples of confidential [red] information include:

• Personal identification numbers
• Special categories of personal data (sensitive data)
• Information regarding health, employment, and salary data
• Research data falling within this category - should be stored on HVL SILAF (research server)

Where can I store such information? Storage guidelines.

Information that must be protected with particularly strict measures

This is the same type of information as Highly Confidential (black), but where specific requirements or considerations necessitate enhanced security.

Large amounts of information or contractual obligations may require additional protection beyond the minimum required by law. The storage and handling of highly confidential information should always be done in close collaboration with and with approval from the responsible Prorector and the IT department.

The systematic processing of special categories of personal and health data should follow the Norm for Information Security and Privacy in Health and Care Services ("the Norm").

If such data is compromised, it could cause significant harm to individuals, public interests, the institution's reputation, or business partners.

Examples of highly confidential [black] information include:

• Large amounts of specific personal data
• Large amounts of health information
• Research data and datasets of significant economic value

Where can I store such information? Storage guide.

Information that can harm national security interests

As soon as you become aware that you will be handling or storing protective information in your work at HVL, which means information related to national security interests, you must immediately consult with:

• The Document Center
• Information Security Advisor
• Advisor for Societal Security and Emergency Preparedness

If necessary, the Rector can authorize HVL employees to work with unclassified or limited protective information.

Under no circumstances can HVL handle or store information that could harm national security interests:

• Confidential (CONFIDENTIAL)
• Serious harm (SECRET)
• Critical harm (TOP SECRET)

UNCLASSIFIED

In addition to the classification of information mentioned above, information that could potentially harm national security interests must be protected in such a way that:

• It is only accessible to those who require it for their duties and have been authorized by the Rector.
• It is not known to unauthorized individuals, even internally at HVL.
• It is not lost or subject to unauthorized alterations.

If the risk assessment deems it necessary, unclassified protective information (according to the Agency Regulations Section 13) must be protected against advanced attack methods.

LIMITED

If the protective information is classified as LIMITED, the requirements for a secure level of security are even stricter.

This information must be protected in such a way that it is not known to unauthorized individuals, including other employees within the same unit or at the same level at HVL.

The information must be labeled as LIMITED (as shown below) and can only be stored in approved locations and information systems specifically designed for this purpose. HVL has such systems that are isolated from other information systems.