Advantages of UvA cloud storage

• Data cannot be lost due to hardware damage / loss / theft

• Data can be accessed from any computer worldwide via web browser (with UvAnetID and two-factor authentication)

• Can be synchronised with one or more local devices

• Multiple sharing options with users within or outside of the UvA

• Version history which allows to restore previous versions of a file

• Recycle bin which stores deleted files up to a certain amount of days

The UvA provides access via the UvAnetID to the personal and group storage clouds listed below:

Research Drive

• Provided by SURF.
• Best suited for research data of groups or individuals.
• Data stored in the Netherlands only.
• Suitable for all types of personal data, including special personal data under the GDPR.
• Request storage size on demand via Research Drive - Service Portal or ictonderzoek-fgw@uva.nl. 
• After your Research Drive space has been created, you can log in here
• You can find more info about Research Drive in the A-Z Research Drive section on the employee site.

Teams/Sharepoint

• Groups storage provided by Microsoft.
• Data stored in Europe.
• Not suitable for special personal data under the GDPR, but can be used for general types of personal data.
• Access via Teams or Microsoft 365 Sharepoint.

OneDrive

• Individual storage of 1TB per user provided by Microsoft.
• Data stored in Europe.
• Not suitable for special personal data under the GDPR, but can be used for general types of personal data.
• Access via the OneDrive application, Teams or Microsoft 365 OneDrive.

SURFDrive

• Provided by SURF.
• Individual storage of 500GB per user.
• Data stored in the Netherlands only.
• Suitable for all types of personal data, including special personal data under the GDPR.
• Log in here with your UvAnetID.

Third-party cloud services & external storage devices

You are not advised to store research data on third-party cloud services, such as Dropbox or GoogleDrive. The reason is that there will be no control over who can access the data. For personal data, you cannot ensure that they are handled according to the privacy law. because the UvA does not have agreements with these providers.

It is not recommended to store data (only) on internal or external hard drives, nor on USB devices, because they can get easily lost, stolen or damaged. If research data needs to be stored on local drives or external devices (e.g. temporarily during field research), please make sure drives and devices are encrypted properly.

All UvA clouds can be used for sharing research data and collaboration by providing UvA members and externals access to files or folders. Among the UvA clouds, Research Drive and Teams/Sharepoint are the most suitable for long-term cooperations and working in teams of UvA researchers as well as external researchers.

For secure sending and receiving of small and large files use SURFfilesender with your UvAnetID. SURFfilesender also allows to send files to externals or to request files from other users and guests. More information can be found on the SURF website.

General

• Never leave your device unattended.

• Use a unique and strong password: minimum 12 characters with 1 digit, 1 upper case letter, 1 lower case letter, and 1 special character. See here for more information.

• Lock your device (Windows key + L), even when leaving for a brief period of time.

• Outside the UvA use UvAVPN. For more information, please see VPN (Accessing the UvA network).

• As soon as you notice any UvA (storage) device is stolen or missing, immediately contact the IT department at servicedesk-ict@uva.nl or cert@uva.nl outside of office hours. More information about (possible) data breaches can be found here.

• For more information about general security measures, please see Security: working safely online.

UvA-managed devices

When using an UvA-managed computer or laptop, basic security measures are already in place.

Self-managed UvA devices

Self-managed devices refer here to private devices which are used for research data and also devices purchased, but not managed, by the UvA, such as Mac or Linux devices for example.

• Register your device with Intune
• Make sure your computer is set up with basic security: anti-malware software, a firewall, and the most recent software updates.
• Information on protecting smartphones and tablets can be found here.

Extra measures for personal data

• Use encryption software, such as VeraCrypt, to secure files/folders or whole drives with content that is particularly sensitive. Please find here a manual on how to encrypt data on Research Drive using VeraCrypt.
• Pseudonymise personal data as soon as possible. Store the pseudonymisation key securely and at a location different from the personal data, e.g. a different cloud. Ensure that only the principal investigator has access to the key.
• With commissioning parties, only share anonymised data. If this proves impossible, sign a data processing agreement with the third party. Contact the Faculties’ privacy officer to assistance, see support below.
• A data protection impact assessment (DPIA) may be necessary. The DPIA tool is used to identify privacy risks for data subjects in advance and to take mitigating measures to reduce these risks. The UvA is not required to carry out a DPIA for all processing activities. However, a DPIA is compulsory if it is likely that a processing activity will expose data subjects to a significant privacy risk – for example, if special personal data are being processed on a large scale. Contact your faculties’ privacy officer to assistance, see support below.
• Apply for approval of the Ethics Committee. Find more information about the Humanities Ethics Committee and their procedure on their webpage Ethics Committee Faculty of Humanities

Faculty Data Stewards

Hanna Fricke & Kamran Adeli  datasteward-fgw@uva.nl

Faculty Security Officer

Silvain Smit s.k.p.smit@uva.nl

Faculty Privacy Officer

Dario Boot privacy-fgw@uva.nl