Skip to main content
Service Pages

Search

Dansk
Menu

Types of information

When we work with GDPR and information security, we talk about different types (classifications) of information. We look at both whether the information says something about certain people (personal data) and what importance the information has for SDU.

Four data types at SDU

Examples and examples
  • Content on sdu.dk
  • Public researcher profiles
  • Contracts Anonymised research data
  • Grade statistics for a subject
  • News articles
  • Programme regulations
  • Research reports


Examples include
  • Employee master data
  • Student numbers
  • Examination numbers
  • Project documents
  • Addresses
  • Course materials
  • Sick notes (without reason)
  • Meeting minutes without closed items
Examples
  • CPR numbers
  • Grades and averages (for individuals)
  • Protected names and addresses
  • Applicants for positions
  • Minutes from closed meetings and meeting points
  • Information about SDU's internal security matters
  • Irregularity cases (cheating cases)
  • Salary information
Examples
  • Health information
  • Information about sexual relationships
  • Genetic data
  • Biometric data (fingerprints, facial scans, etc.)
  • Trade union membership
  • Race and ethnic origin
  • Whistleblower cases and other "scandalous" cases
  • Research results with military applications (dual-use)

Data can be both personal and business data at the same time

For example, information about students is both personal data (because it is about students) and business data (because we use it for programme administration). Information can easily be classified at different levels for people and for business. For example, information about an employee published on sdunet.dk will be "public business information" but "ordinary personal information".

Personal data

Information is personal data if it tells you something about a person who is either identified, can be identified from the information, or can be identified by comparing the information you have with other information. Depending on the type of personal data, the information can be either 'general', 'confidential' or 'sensitive' to the people it is about.

Business information

Business information is information that is of importance to SDU. This applies to virtually all information we process or use at SDU. Depending on the importance of the information to SDU and how critical it is if the information is leaked, the information may be "public", "internal", "confidential" or "sensitive/secret" to SDU.

Know the type of information

  • If the data is not about an identified person - either because it is not about a person at all or because it is anonymised - it is not personal data. Then there are no GDPR requirements on how the data can be processed.

    Public business information is information that has been published or is intended to be published. This could be published research articles or texts for sdu.dk, for example.

  • General personal data is personal data that is neither confidential nor sensitive. This could be master data about employees or user information in an IT system.

    Internal business information is information where it would cause SDU less significant problems if it were made public. For example, it could be internal communication between employees, or course materials with copyright.

  • Confidential personal data is information that SDU is generally expected to take good care of. This could be, for example, CPR numbers, or it could be information that has been provided for research projects in confidence. Students' grades are also confidential.

    Confidential business information is information that may be of more significant importance to SDU if it is made public. This could be information that is subject to confidentiality agreements in connection with research collaboration, information about patentable inventions or minutes from closed meeting agenda items.

  • Sensitive personal data is data revealing racial/ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning a person's health or sex life/sexual orientation. The GDPR has particularly strict requirements for this type of data. At SDU, we also put information about criminal offences in the same category when we classify data - in principle, they have their own rules in the GDPR, but for SDU the conclusion is almost always the same: We need to take extra care of the data.

    Sensitive (or "secret") business information is information that could do great harm to SDU if shared with unauthorised parties. It could be internal discussions about financial issues or other vulnerable matters, or it could be research results that could be used for warfare or cyberattacks.

  • Special protection of personal data applies when it concerns children.

    Therefore, keep that in mind:

    • all information should be written in a simple and clear way - especially if it is directed towards children
    • both children and parents should be aware of how personal data is processed (consent, duty of disclosure, etc.).

Do you have any questions?

The GDPR and Information Security Coordinators are your local contact and advisor for day-to-day data protection and information security at SDU.

See also