Training and good behavior
Good behavior requires training of the research / project group so that they are familiar with
- the technical processes necessary for safe registration and storage of research data
- the conditions of the workplace in which they process the research data (prevent transparency by not working in public places with sensitive data, always lock the screen when leaving the room, etc.)
- the procedures that at any time apply for reporting routine non-conformities and security breaches.
Access control
Access control means that the project manager must determine what type of access the various project participants should have to different types of data in the project and for what period of time this access should apply. Procedures for access control and safe data storage must be prepared.
The requirements for proper handling and storage are stricter if more people are to have access to the raw data (access to the scrambling key). It is also important whether the project participants are here at HiOA or elsewhere.
Example of access:
Nn: access to unidentified data (see definition list) for a limited period of the project.
Personal data is anonymized, if person identifiers are removed, so that the information can no longer be linked to a single person (the Personal Data Act does not apply).
Nn: access to raw data for the entire project period.
Example of access control:
The research assistant, assumed November 13, 2014 to April 14, works to transcribe audio recordings. Encrypted memory sticks with audio recordings are stored in cabinet A; transcribed material is stored in cabinet C. The project manager and the research assistant have access to the key for the cabinets and they are familiar with the encryption key. The project manager changes the encryption key on the memory stick after the research assistant has completed the work.
Project participants must be familiar with HiOA' data security system, and receive training in procedures for where and how research data can be stored - electronically or physically, in the individual project.