Data classification in M365 files (Word, PowerPoint, Excel)

Read more about data classification at the University of Helsinki on the landing page.

Whenever you create an M365 file or start editing a file that has not yet been classified by the University of Helsinki, you must assign a data category to the file.

The category must always be selected according to the risk level of the data content. If the content changes in such a way that its risk level changes, the category must always be changed to match the data content.

Categorise the file by selecting Sensitivity from the Home menu. 

Here is a more detailed list of the data categories used by the University of Helsinki in files, as well as their more detailed settings and restrictions.

File categories and restrictions

Secret (1R)

• Subcategory: Encrypted
  • Files are encrypted and protected using Microsoft technology, also forces users to be identified
  • The category appears as text at the top of the file
  • Sharing the file as an anonymous link is blocked
  • Access to the file by AI applications is blocked
• Subcategory: Unencrypted (not recommended)
  • Encrypt yourself 
  • The category appears as text at the top of the file
  • Sharing the file as an anonymous link is disabled
  • Access to the file by AI applications is blocked

Restricted Confidential (2A)

• Subcategory: Encrypted
  • Files are encrypted and protected using Microsoft technology
  • The category appears as text at the top of the file
  • Sharing the file as an anonymous link is blocked
  • Access to the file by AI applications is blocked
• Subcategory: Unencrypted (not recommended)
  • Encrypt yourself 
  • The category appears as text at the top of the file
  • Sharing the file as an anonymous link is disabled
  • Access to the file by AI applications is blocked

Private (3Y) and Internal (4G)

• Does not require encryption
• The category does not appear as text at the top of the file
• Sharing the file as an anonymous link is blocked
• The file is not blocked from being used by AI applications

Open (5W)

• Does not require encryption
• The category does not appear as text at the top of the file
• Sharing the file as an anonymous link is not blocked
• File access by AI applications is not blocked

Personal (non-work related)

• Use encryption when necessary
• Category not shown as text at top of file
• Sharing the file as an anonymous link is not blocked
• Use of the file by AI applications is blocked

In classes 1R and 2A, files are encrypted and protected by Microsoft technology directly by selecting the Encrypted subclass.

Encryption means that the contents of the file are only readable by authorized users.
Protection means that the use of the file (e.g. copying, printing) can be restricted.

The file is then restricted:

• only for named users or
• only for University of Helsinki users

When you select the 1R - Encrypted class for a file:

• the file will be encrypted and protected only for the users of the University of Helsinki you select.
• this will open a window where you can further specify who can read and edit the file.
• no one other than your chosen users will be able to open the file.

When you select the 2A - Encrypted class for a file:

• the file will be encrypted and protected only for the users of the University of Helsinki.
• No one other than the University of Helsinki users will be able to open the file.

Sending a 1R or 2A file outside the university

If you need to share a 1R or 2A file with someone outside the University, it is possible to use the subclass Unencrypted (Not recommended). In this case the file itself is not encrypted, but this is done separately when the file is sent by email.

Once you've saved a file to, for example, your OneDrive folder or a shared Teams folder, you can share the file with a link. When you share, you make a choice about who you give access to the file via the link.

• See also the separate instructions on file sharing

The category you choose for a file will affect how widely you can share the file as a link.

Sharing a file with an anonymous link

Sharing a file with an anonymous link (Anyone with the link) means that anyone who knows the link can access the file without authentication.

File sharing with the link is only possible for the following categories:

• 5W - Open
• Personal (non-work related)

Sharing with a limited number or individual users

Files classified as 2A-4G can be shared:

• to all users of the University of Helsinki or
• to people you choose.

Notes about sharing

• If you set permissions on the share link for all University of Helsinki users, then all University of Helsinki users who know the link will also have access to the file. In this case, you cannot grant access to the file to people outside the University.
• If you share the file with selected people as a link, only those people will have access to the file. The selected persons may also include users outside the university.
• It is also technically possible to create a share link to designated users for 1R classified material. However, when sharing and storing material in this category, careful, case-by-case judgment must be exercised as to where the material needs to be processed.

For files classified as 1R or 2A, the class name is automatically displayed at the top of the file as a watermark.

The watermark helps the recipient to identify the class of the content even when it is shared outside the organization.

Currently (year 2026), the University of Helsinki model does not display a watermark for files classified as 3Y-5W and Private.

You can use files from categories 3Y-5W with AI applications supported by the university (e.g. Copilot, Curre).

Categories 1R, 2A and Personal files are completely blocked from AI applications.