The data owner (e.g., project leader or process/system owner) is responsible for:
- Assessing the data before processing begins, classifying it, and ensuring it is placed in the correct category according to the guidelines below.
- Reclassifying the data if its nature changes during processing.
- Regularly checking compliance with any changes in requirements and legislation.
- Ensuring that all storage, processing, and handling of the data are done using solutions approved for the data category - see NIH's storage guide
Categories and risk level
NIH uses four categories/color codes for data. These categories cover all types of information, including non-personal data. The categories refer to different risk levels - how much damage could occur if the information is compromised:
Black: Strictly Confidential
- Used if disclosure could cause significant harm to public interests, NIH, individuals, or partners.
- Black data must be stored in NIH-approved secure zones; Educloud or TSD (both operated by UiO), depending on the project's nature. Nettskjema can be used for black data if it is handled using Educloud or TSD.
Examples: Large amounts of special category personal data (formerly known as sensitive personal data), research data and datasets of significant
Red: Confidential
- Used if disclosure could cause harm to public interests, NIH, individuals, or partners.
- Nettskjema can be used for handling red data, and collected data must be stored according to NIH's storage guide.
- Examples: Information containing special category personal data (formerly known as sensitive personal data), including health data, personnel files, data subject to export control, some information on building and IT system security.
Yellow: Limited
- Requires some protection. Can be available to external and internal parties with controlled access rights. Could cause some harm to the institution if disclosed.
- Examples: Personal data not covered under red or black, grades, exam answers, pseudonymized data.
Green: Open
- Used if disclosure causes no harm to the institution or partners.
- Data integrity must still be ensured by allowing only authorized persons to modify the information. Note that even if the data is open, it is not free to use as you wish.
- Examples: Freely available research data that needs no protection, teaching materials deemed not to need protection, pre-prints, information pages for institutes, laboratories, staff, etc., publicly accessible websites.