Classification of data

Public data is data that is available to the public, and where publication will not harm AU.

• AU’s websites, e.g. au.dk
• Study descriptions
• News articles
• Books
• Research data (open data)
• Res
• Own personal data or other people's personal data, provided consent has been given. Including:
• Basic information about employees (name, job title, tel. no.)
• Affiliation to institutions

Internal data is information that only staff at AU with a purely work-related need may and can access. Breaches of confidentiality in relation to internal data will have a low-level negative impact on AU, private individuals and partners.

General personal data in accordance with Article 6 (‘Lawfulness of processing’) of the General Data Protection Regulation, including:

• Basic information (name, telephone, address, date of birth)

• Data on education, references, course certificates and work assignments 

• Data on salary, tax, pension and salaries account number

• Driving licence number and type

• Nationality

• System user information (e.g. AUID)

• Absence data (however, only about the period of absence, not treatment, diagnosis or the reason for the absence)

• Participation in classes/courses/groups and course level

Typical information

• Work schedule
• System configuration
• Department/unit budget
• Procurement agreements
• Teaching materials
• Research data
• Minutes and/or agendas of meetings

Confidential data is information that only staff at AU with a purely work-related need may and can access. Breaches of confidentiality will have a medium-level negative impact on AU, private individuals and partners. 

Inventions and research that can be exploited commercially of a value > DKK 1,000,000.

Research data with potential negative impact

Personal data classified as confidential at AU, including:

• Civil reg. no. (CPR no.)
• Employee's home address, private email address, private telephone no. and other private information
• Personality test
• Marital status
• Adoption details
• Grades, grading etc.

Important!

In exceptional circumstances, there may be situations in research in which you cannot avoid working with confidential and sensitive AU data in direct individually identifiable form (e.g. civil registration numbers) on the secured network drives, where you may otherwise only store and share pseudonymised or anonymised data. In these situations, it is very important that the work requiring that the data is directly individually identifiable is finalised and completed as quickly as possible, after which you must pseudonymise or anonymise data.

Documentation

If you need to save/store confidential data and/or sensitive data, the university requires that you make an assessment of the need for, and the risk of, storing data, and that you describe how you store data, whether to add meta data and a plan for erasing data 

You should also consider whether publication will harm partners, researchers, employees or students and thereby also AU, whether publication will cause major or minor problems for AU’s work, tactical objectives or survival and whether publication could have criminal implications. 

You must store a description of the above locally – preferably in a filing system. The information is primarily to be used if there is a need for documentation of the purpose of storing and processing data, e.g. in connection with a case with the Danish Data Protection Agency.

Sensitive data is information that only staff at AU with a purely work-related need may and can access. Breaches of confidentiality will have a high-level negative impact on AU, private individuals and partners.
This is information which, by its personal, technical, commercial or competitive and sensitive nature, must be secured at the highest level against accidental access and publication. 

Research applications of a value for AU > DKK 5,000,000

Research documentation with sensitive personal data

Sensitive personal data pursuant to Article 9 ('Processing of special categories of personal data'), including:

• Race and ethnic origin
• Political opinions, religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data for the purpose of unique identification
• Data concerning health
• Sex life or sexual orientation
• Criminal offences pursuant to Article 10 of the General Data Protection Regulation (‘Processing of personal data relating to criminal convictions and offences')

Important!

In exceptional circumstances, there may be situations in research in which you cannot avoid working with confidential and sensitive AU data in direct individually identifiable form (e.g. civil registration numbers) on the secured network drives, where you may otherwise only store and share pseudonymised or anonymised data. In these situations, it is very important that the work requiring that the data is directly individually identifiable is finalised and completed as quickly as possible, after which you must pseudonymise or anonymise data.

Documentation

If you need to save/store confidential data and/or sensitive data, the university requires that you make an assessment of the need for, and the risk of, storing data, and that you describe how you store data, whether to add meta data and a plan for erasing data 

You should also consider whether publication will harm partners, researchers, employees or students and thereby also AU, whether publication will cause major or minor problems for AU’s work, tactical objectives or survival and whether publication could have criminal implications. 

You must store a description of the above locally – preferably in a filing system. The information is primarily to be used if there is a need for documentation of the purpose of storing and processing data, e.g. in connection with a case with the Danish Data Protection Agency.