Guide to Thesis Data Management, Data Protection and Research Ethics

Final processing of data

When a thesis is completed, the thesis material must be finalised. The student is obliged to keep the data for six months after completion. Data must be actively and consciously either prepared for destruction or steps taken to preserve the data for further use or open access.

The following decisions need to be made regarding the data used in the thesis::

• whether to destroy or retain some or all of the data
• where to store the data to be retained, and whether it should be anonymised
• whether the data, or part of it, can be made available to others

Destruction of material

The most common practice for data disposal is to destroy the data six months after completion of the thesis.

Destroy your thesis data in the following cases:

• You have not informed your subjects in advance about further use of the data.
• The data containing personal information will not be anonymised.
• You have not agreed otherwise with the university or the commissioner.

• If the participants have not been informed about the re-use or open access use of the data and this has not been agreed with a representative of working life, the data cannot be further used or opened. This also applies, for example, to quotes are taken directly from the data for use in company marketing material or social media.
• If the thesis material contains personal data or other confidential information, for example company data, the data cannot be kept unanonymised, re-used or published with open access.
  • This data must either be anonymised or destroyed, as there is a risk to data protection or a risk of damage to the company's reputation.
• It is also worth discussing with the commissioner whether the name of the company or organisation will be used as such in the thesis report or whether, for example, company X will be referred to.

Re-use or open access publishing of data

In the planning and contracting phase of the thesis, it is worth considering whether the material is to be used after its completion.

If, when you are starting your thesis, it appears that 

• the material could be used for development or marketing purposes in the partner company or organisation, or
• the material could be further used by another student or Laurea

that must be made possible through planning measures and documented in the data management plan.

The possibility of further use must be ensured in advance and during data collection/processing:

• in the agreement to be made with the work partner 
• research authorisation
• when informing the subjects and obtaining consents
• by following good data management practices
• by anonymising the data.

It may not be possible to ask for permission afterwards, so if you are planning to enable the re-use or open access publishing of your data, please take this into account in your data management plan. 

Anonymisation of data
Anonymisation of data means that the data is processed so that it no longer contains any personally identifiable information. Therefore a person can no longer be identified from the data by any reasonable means. Organisational, company or other confidential data can also be anonymised from the data.  

• In open-ended responses, someone may tell you various things about themselves
• The IP address of the respondent is recorded in the questionnaire
• In an interview survey, a person may start talking about an identifiable or sensitive issue on their own initiative.