Skip to content

Purpose and scope of this Document

This document defines privacy data classifications and workflows for compliant handling of personal data in IT solutions.

Section 1 - Classification Schema

Core Data Categories

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
{
  "contactInformation": {
    "elements": ["First name", "Last name", "Email"],
    "legalClassification": { "gdpr": "General personal data" },
    "novoClassification": { "generalPersonalData": true }
  },
  "healthInformation": {
    "elements": ["Medical Records"],
    "legalClassification": { "gdpr": "Special categories" },
    "novoClassification": { "specialCategories": true }
  }
}

Definitions

  • elements: Specific data fields (e.g., email, medical records).
  • legalClassification: Regulatory mapping:
    • gdpr: GDPR categories (General/Special)
    • pipeda: Canadian privacy law tiers
    • hipaa: U.S. health data rules
  • novoClassification: Internal risk tiers:
    • generalPersonalData: Basic identifiers (non-sensitive)
    • confidentialPersonalData: Financial/government IDs
    • specialCategories: Health/biometric/ethnicity data

Section 2 - Documenting Personal Data in Solutions

1. Identify Data Subjects

Data Subject Type Parent Category Description
Employees HR Current/former employees
Patients Development Clinical trial participants

2. Classify Data Elements

General Personal Data:

1
2
3
4
# risk.yaml snippet
generalPersonalData: 
  - "First name"
  - "Email"

Special Categories:

1
2
specialCategories:
  - "Medical Records"

3. Map Data Flows

Example risk.json:

1
2
3
4
5
6
7
8
{
  "privacy": {
    "dataOnMinors": true,
    "dataSubjects": {
      "patients": { "elements": ["healthInformation"] }
    }
  }
}

Key Rules

  • Flag specialCategories in pipeline templates.
  • Document cross-border transfers.
  • Review classifications quarterly.

Ownership: Data Privacy Office (DPO@novonordisk.com)
Reference: Full Classification Schema