Responsible use of data

SDU Analytics follows applicable national and international legislation. The main focus is on the Danish Universities Act, the Danish Public Administration Act, the EU General Data Protection Regulation (GDPR) and the EU AI Act.

SDU also follows its internal policies and guidelines on data protection and information security. SDU Analytics stays in ongoing dialogue with Governance, Risk & Compliance in SDU IT to clarify the legality of data use.

For larger projects involving external parties, data processing agreements are concluded through RIO’s legal advisers. As a rule, personal data is processed on the legal basis set out in Article 6(1)(e) of the General Data Protection Regulation: performance of a task carried out in the public interest or in the exercise of official authority.

When SDU Analytics uses individual-level data, this will normally involve ordinary personal data, and only to the extent necessary to carry out the task.

Most data is presented in aggregated form, typically as descriptive statistics with no possibility of identifying individuals.

In rare cases, and only after a specifically defined request and management approval, sensitive data may be processed under enhanced control measures.

SDU Analytics works from a fundamental principle of responsible data use:

• Data must be collected for a clear purpose.
• Only the necessary data may be collected.
• The relationship between the volume of data and its use must be proportional to the expected benefit.

If employees in SDU Analytics are in doubt about ethical perspectives, the Data Ethics Canvas tool from the Open Data Institute is used as a dialogue tool with their immediate manager.

The dialogue is used to assess what may constitute responsible use in the specific situation. The immediate manager clarifies this with the divisional head.

In special cases, an assessment from the University Director, Executive Board or Rectorate may be needed, but in day-to-day practice, data ethics is the responsibility of the divisional head.

SDU Analytics uses data from both internal and external sources. Data is extracted and used specifically for analyses in web reports and documentation.

The main data sources are:

• SDU’s internal administrative systems, for example HCM, CRM, PURE, SDUpro, STADS, DANS, KOT, Optag Manage, ODIN, Digital Eksamen, INTADM and Selfarranged.
• Survey data from studies, for example Denmark’s National Student Survey, SDU’s Study and Teaching Environment Survey, as well as course evaluations.
• The Ministry of Higher Education and Science data warehouse (UFM).
• The Ministry of Children and Education data warehouse (UVM).
• Public data from Danish Universities’ analytical preparedness service (DKUNI).
• The Danish Research Portal.
• Statistics Denmark.
• Bibliometric and altmetric tools such as Scival, Scopus, Web of Science and Altmetric.
• ERC and the websites of other award and funding bodies.
• International ranking databases.

SDU is the data controller for its internal business systems, and SDU Analytics only uses external data with due regard for the respective ownership rights and data protection requirements.

Most analytical support is published as web reports with aggregated statistics on SDU’s Analytics Portal.

SDU’s Analytics Portal is available with and without a licence. Access by licence is granted to SDU staff by agreement. SDU Analytics also communicates via SDUnet, where information about analytical support is available to SDU staff.

Students and external parties do not have access to SDU’s Analytics Portal or the service page on SDUnet, but they can use the information made publicly available via

SDU Analytics has two shared mailboxes:

sduanalytics@sdu.dk for questions about analytical needs.

dataadgang@sdu.dk for access control and allocation of a licence for SDU’s Analytics Portal.

Most deliverables and services are web reports that present aggregated statistical data as KPIs, tables and graphs. Most of it is descriptive statistics.

The data quality in SDU Analytics’ analytical basis is well consolidated. Work is based on strong analytical expertise, well-documented agreements, and transparent processes and annual cycles.

The use of data is assessed continuously by staff and management in SDU Analytics through a shared governance framework that ensures sufficient data quality, effective processes, and the necessary analytical expertise.

In the web reports on SDU’s Analytics Portal, limitations and points of attention are described where this is considered necessary.

There is typically an "About" section that helps the user understand and interpret the information shown.

SDU Analytics also maintains an ongoing dialogue with management and the organisation about the content and use of each web report.

Staff in SDU Analytics always have the opportunity to express their perspectives on the use of data in connection with task delivery, and no concern is too small to raise.

At management level in SDU Analytics, an overall assessment is made of the purpose, potential risks and consequences of using data. This includes assessments of data quality, sensitivity, source reliability and any bias in presentation and use.

It is always management’s assessment that expresses SDU Analytics’ organisational view of whether data can be used responsibly, as the responsible use of data, priorities and resources falls within the remit of the Head of Department.

An overall risk assessment for 2025 shows low risk and low impact in the use of data within SDU Analytics.

Systematic logging and access control are maintained in relation to users’ use. No inappropriate use of the analytical support has been observed. In addition, formalised access management is enforced.

Specific points of attention in the data work:

• Constructed CPR numbers in certain systems.
• Binary gender registrations based on CPR numbers, which do not reflect contemporary understandings of gender.
• Missing or incorrect registrations of nationality in some integrations.
• Possible identification of individuals in small data groups via filter functions.
• Users’ over-interpretation of simple descriptive statistics, which may lead to communication of causal relationships even when this is not the case.

Several of these issues are addressed through ongoing data cleansing and quality assurance, as well as clear communication about operationalisations and reservations regarding interpretation.

Where risks are identified, SDU Analytics works proactively with the DPO, Governance, Risk & Compliance in SDU IT, and the legal advisers in the legal unit of the SDU Rectorate Staff.