This page describes how to process different types of information with private ICT equipment (such as a private PC) at NTNU.

Norsk versjon - Behandle informasjon med privat IKT-utstyr

NTNU’s management system for information security and GDPR oblige the organization to have an overview of information assets that are stored and kept at NTNU and to ensure that these are sufficiently secured. As a consequence, private equipment should not be used for storage of information classified as Internal, Confidential or Strictly Confidential. Furthermore, private equipment should not be used to process information in the Confidential or Strictly Confidential classes. Which category a specific type of information belongs to is determined by NTNU's guidelines for classification of information. A typical example of classified information is information containing personal data.

NTNU’s procedures and guidelines require the use of managed NTNU machines equipped with necessary security mechanisms to process classified information. However, situations may arise where classified information must be processed on non-managed devices. This applies particularly to students but may also apply to PhD candidates or others who for various reasons do not have access to a NTNU-managed PC.

It is not always easy to keep track of where data is stored and whether it is stored sufficiently when using various cloud solutions and storage areas. This makes it especially difficult when processing takes place using private equipment. Below you will find information on how to proceed for the most common types of personal data

Terms and abbreviations

Home directory: The home directory (M:) is located on a central server at NTNU. The area is personal and protected by your password so that no one else has access to your files. The home directory is approved for storage up to confidential information (up to strictly confidential with encryption). The disadvantage of using the home directory for storage of data material is that no one else (such as a supervisor) can access it.

NICE-2: NICE-2 is a service for storing, analyzing and processing research data that requires extra security. NICE-2 is particularly suitable for qualitative data and smaller, internal research projects and student assignments. Here you can both store and work with research data and other types of data in secure project areas, with a selection of available software. NICE-2 is approved for confidential (red) data, and is well suited for students who use their own PC.

Office 365: Office 365 provides students and employees at NTNU with free access to word processing, cloud storage, and collaboration services. Here you will find Teams, Outlook, OneDrive, Word, Excel, and PowerPoint, both for downloading and for use use through your web browser. If you use a private PC, you must be careful not to store any Office files on the PC (they can be stored on Teams).

Personal data is information that can directly or indirectly identify a person. Directly identifiable personal information includes, for example, name, social security number, email address, phone number, IP address, images, audio recordings, and video recordings. Transcribed interviews are also considered personal data unless all directly and indirectly identifying information has been removed. Indirectly identifiable personal information is background information that can make it possible to trace the information back to an individual, such as workplace combined with information about age, gender, occupation, nationality, etc.

Teams: Microsoft Teams is a cloud-based tool for communication and collaboration in groups but can also be used as a storage area if you cannot store on your own PC. If you create a private team, you can use it for storage with access control.

Webex: Webex - Confidential Digital Interview is a service for digital interviews and meetings with confidential content. It consists of a web portal to plan and send meeting invitations, and the Webex tool for conducting meetings with recordings. The recordings are automatically transferred to your project in NICE-2 or your home directory on NTNU servers.

Information classification

All information you process and share has different needs for security and protection. At NTNU, we use four categories to classify confidentiality level: Open (green), Internal (yellow), Confidential (red), and Strictly Confidential (black). For more information on classification, see Policy for Classification of Information Assets and Classification of files and documents.

About the classification of personal data

Ordinary personal data (non-sensitive) is usually classified as internal (yellow). This is information that can be related to a person but do not contain so-called special categories of personal data (also called sensitive). Special categories include information about racial or ethnic origin, political opinion, religion, belief or trade union membership, processing of genetic information and biometric information for the purpose of uniquely identifying a physical person, health information or information about a physical person’s sexual relationship or sexual orientation. This information requires a higher level protection and is usually classified as confidential. Other examples of confidential data are information about criminal convictions and offenses or information about people from vulnerable groups or in vulnerable situations.

There are examples of Strictly Confidential (black) personal information in research. Strictly confidential is used if it could cause significant harm to public interests, the institution, an individual or a partner if the information becomes known to unauthorized persons. An example of such information may be information about persons who require special protection (code 7).

For more information, see Guidelines for the processing of personal data.

Examples of data flows for research data with personal information

Yellow interview data via Nettskjema Diktafon App

1. Log in to Nettskjema and create a new form using the template "Nettskjema-diktafon - storage in Nettskjema".
2. Download the Nettskjema Dictaphone app to your mobile and use the app to record interview (follow instructions from UiO).
3. Listen to the files in Nettskjema via Browser. (NB: Nettskjema automatically transcribes the recordings, but the quality varies.)
4. Copy the transcriptions to a Word file on Teams or your home directory (do not download to your own PC).
5. Save the transcribed texts on Teams or your home directory (M:). Make sure to not save anything on your own PC.

Yellow digital interview data via Zoom

1. Set up recording in Zoom with storage on home directory (M:-disk)
2. Play the files with VLC player (downloaded from NTNU)
3. Work with text files in Word (Office 365),
4. Save Word files on Teams.

Yellow video data

1. You can use a digital video camera to make recordings, but this requires that you are careful to delete the information from the recorder afterwards (see procedures for deletion below).
2. Transfer video files directly to your home directory (M:). For more information on how to connect your home directory as a folder on your PC, see wiki about Home Directory.
3. Play the files with VLC player (downloaded from NTNU)
4. Work with text files in Word (Office 365).
5. Save Word files on Teams.

Red interview data from dictaphone/external recording device

1. Order a project room in NICE-2 (for students, supervisors must order the project room).
2. You can use an external dictaphone/audio recorder to record confidential interviews, but this requires that you are careful to delete the information from the recorder afterwards (see procedures for deleting).
3. Transfer files directly to NICE-2.

Red video data

1. Order a project room in NICE-2 (for students, supervisors must order the project room).
2. You can use a digital video camera to make confidential recordings, but this requires that you are careful to delete the information from the camera afterwards (see procedures for deleting below).
3. Transfer files directly to NICE-2.

Red digital interview data

1. Use the Webex service when conducting and recording digital interviews and meetings with confidential information (red data).
2. The recordings are automatically transferred to your project in NICE-2 or your home directory on NTNU servers.

Deleting information

External storage media

• Windows: Connect external storage media to your PC, find the media, right-click and select Format. Select NTFS file system, make sure “Quick format” is not checked, and click Start. NB: It is important to use full formatting to prevent information from being recoverable.

• MacOS: Connect external storage media to your Mac. Open Disk Utility, select the device under External, click Erase, and select the desired format from the menu. (Use MS-DOS (FAT) for 32GB and smaller, and ExFat over 32GB unless you have a good reason to choose other formats.) Click Security Options and move the switch all the way to the right before clicking Erase.

Deleting files from personal computer

Delete the file from the relevant storage areas, then delete the file from the trash.