Well planned is half done, also in a thesis. Planning the work carefully will help you complete the thesis process. The planning phase proceeds as follows:
Once the supervisor has approved the completed part, 5 out of 10 credits will be registered in Peppi for the planning phase.
The thesis process uses the Wihi system, where all communication related to the thesis and the return of documents related to the thesis take place. The process starts with a topic suggestion (= idea paper), which you fill in first in Wihi. Wihi instructions are included in the Peppi instructions.
All the communication related to the theses takes place in a single system, Wihi:
There are three roles in Wihi:
Coordinator
Supervisor
Student
The thesis consists of three phases, with a scope of 5 credits (ECTS) in a UAS bachelor’s degree and 10 credits (ECTS) in a UAS master’s degree. There are separate instructions for each phase:
The topic proposal is a preliminary plan for your thesis, in which you explain what you plan to do, why, how and when. Your work should relate to the core content of the study programme and the practices of the sector.
You will prepare a topic proposal for approval, as a basis for discussion in thesis group and to support your own work. Start your thesis process by making a topic proposal in Wihi. If there is more than one author, one of you should draft a proposal and invite the others to join. You can find more detailed instructions on how to create a topic proposal in the Wihi instructions.
Information to be added to the topic proposal:
Background information about the authors/author
Description of the work content, objective and result
Detailed description of the work content of the work, goal and desired outcome. Explanation of what the outcome of the work will be in practical terms. In the case of a diary-type thesis, the description of the main tasks here.
Description of the significance, utilisation of the work results
Explanation of who needs the result and for what purpose, as well as the benefits during the use of the finished result. In the case of a diary-type thesis, a description of the key competences required.
Planned tools
Planned working methods
Commissioner information (may be preliminary)
Abilities
The possibilities of the student to carry out the proposed work. A list of advanced professional studies completed by the student before starting the thesis, at least the RDI studies supporting the suggested thesis. Any other studies or work experience that support the thesis.
Approval of the topic proposal
Submit your topic proposal to Wihi for approval. If there are multiple authors, you cannot submit a proposal until everyone has accepted the invitation in Wihi.
The thesis coordinator reviews your proposal and provides feedback to help complete it, if necessary. Once the proposal complies with the agreement, the coordinator will approve it and appoint at least one supervisor for your work.
You must present your topic according to your degree programme instructions. Once your topic proposal has been approved, you will be allowed to start working on your thesis.
During the planning phase, you prepare a plan for your thesis, in which you describe the background, purpose, objectives, approach, methods, implementation, evaluation, ethical aspects, schedule and possible costs. If there is more than one author, agree on the division of tasks.
Prepare a plan by using the thesis template and return it in Wihi to the supervisor(s) for comments.
Structure and content of the thesis plan
1. Introduction
2. Knowledge base (create titles that describe the content)
3. Purpose, objectives and the framing of a question
4. Methodological implementation
5. Ethical foundations and reliability
6. Timetable and required resources
A data management plan is drawn up as an appendix to the thesis plan, with a view to ensuring that data is collected, analysed and stored in accordance with data protection requirements in connection with the thesis work.
The goal is also to ensure that ethical aspects are taken into account in the thesis. The data management plan describes how the data will be acquired, how it will be used, where it will be saved, how it will be retained, and what will happen to it when the thesis is completed.
The data management plan is prepared by using a template prepared by Arene, which can be found here. You can also watch the attached video on the preparation of the plan.
During the planning stage of the thesis, at the latest when preparing the data management plan, it is good to consider whether you process or collect personal data in your thesis. The purpose of data protection legislation is to create a legal framework for the processing of personal data.
As a general rule for theses involving personal data, if a thesis relates to living persons you collect or process personal data. Data protection regulation also applies to published personal data such as personal data collected online. Data protection provisions do not apply to the processing of previously anonymised data.
1. Find out if your thesis involves the processing of personal data
Personal data
Personal data is defined in the EU’s General Data Protection Regulation (2016/679) as follows: “personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Personal data can be any information that relates to an identified or identifiable person and that makes the person identifiable.
According to the Office of the Data Protection Ombudsman, personal data includes:
Personal data is divided into personal data that enables direct and indirect or indirect identification.
Examples of personal data that allow direct identification include:
Personal data that allows indirect identification includes:
In the processing of personal data, it should be noted that a person is almost invariably identifiable by combining various indirect or secondary personal data. The more data available, the easier it is to identify a person.
The processing of personal data is defined in the GDPR as follows:
“‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.
For example: if you save a survey respondent’s name, or the respondent can be identified otherwise afterwards, you are processing personal data.
Personal data in surveys and interviews
The collection of personal data can be carried out by means of a questionnaire, by interview, by observation or by collecting personal data from online services.
Even when answered anonymously, personal data is processed if the collected data can directly or indirectly identify the respondent.
A person may also be identifiable on the basis of collected background information (e.g. age, gender, education, place of residence, professional title, workplace).
If you are conducting a survey or interviews and cannot determine in advance whether the answers will generate personal data, you should assume that you are processing personal data.
The starting point of statistical research is that groups of less than five respondents are not processed, so if you get the only 68-year-old male midwife student to respond to your survey, you must eliminate the possibility of identification during analysis so that individuals can no longer be identified in the final thesis. This should also be communicated to respondents in advance.
Always specify the source of contact information
If you have received a list of contacts from the thesis supervisor, you can use them to contact people.
However, when you contact someone, let them know right away where you got the information. It is also recommended to agree with the supervisor that you will destroy the data when you no longer need it. You must not store the information in your email or other personal files.
Photos and videos
If you use photos of an individual person in your thesis, agree with them about it. If you are taking photos at an event and the photo shows several people, it is a good idea to announce that you will take photos during the event that may be published in the thesis. It is recommended to give participants the chance to avoid the camera.
Photographing children is not allowed for theses.
Personal data obtained from public sources
Be careful when processing personal data obtained from public material. Public material includes legal cases, for example.
In that case, note that even if a person’s information is visible somewhere in public, you must have grounds for including them in the thesis as they are.
If it is a person that performs or has performed a public task, you can also use the information in public, but if it is a private person, for example, and it is not necessary to specifically mention their name, you should avoid this.
For example, if you are referring to a case, even if the Supreme Court documents show the name of the person whose case has been processed, you can refer to the case and the person, e.g. with the letter X.
You can still refer to publications using the author’s name, and this does not require any special measures in terms of data protection.
Sensitive personal data
Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.
Sensitive personal data also includes health data as well as genetic and biometric data.
The processing of sensitive personal data for theses is, in principle, prohibited in accordance with the data protection policy of the Lapland University Consortium.
Processing of sensitive personal data as part of studies leading to a degree is, in principle, prohibited and allowed only in exceptional cases. Examples of such special exceptions are studies that absolutely require the processing of sensitive personal data. 2. If your research task involves the processing of personal data, clarify your role and responsibilities in the processing of personal data
Data controller
‘Controller’ refers to an entity that alone or jointly with others determines the purposes and means of the personal data processing.
Therefore, the data controller is the party for whose purposes the personal data is processed and who makes the decisions concerning the processing of personal data.
The data controller is responsible for ensuring that the processing is carried out correctly and legally, respecting the rights of the data subject.
For theses at Lapland UAS, the data controller is the student together with the UAS unit responsible for the field.
The university of applied sciences is represented here by the thesis supervisor. In some cases, the controller may be a commissioning or partner organisation.
Processing of personal data
Data processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.
In that case, the data controller is another party and the data processor processes personal data on behalf of the data controller. For example, a person providing marketing services may be a processor of personal data when receiving customer name and contact information from the data controller.
In that case, there must be a written agreement between the data controller and the data processor regarding the processing of personal data. The data processor is also partly responsible for the processing of personal data, but their responsibility is more limited.
The processing of personal data must always have legal grounds that must be determined before the processing begins.
It is not possible to change the grounds later. The grounds for processing affect the rights of the data subjects in relation to the data controller.
Theses for UAS degrees are usually based on the subject’s consent. The basis may be the controller’s legitimate interest when a thesis is based on register data.
Provision of information to a study subject and consent
If you process personal data, you must inform the data subject. No provision is made for a specific form of notification channel (e.g. a privacy policy), but as a general rule the information must be provided in writing.
This allows you to take care of the data controller’s accountability, which means that the data controller must be able to demonstrate compliance with data protection legislation.
The template of the Privacy Policy can be found here. (link will be updated soon)
Privacy notices are always archived in Lapland University of Applied Sciences’ Dynasty case management system.
Save the privacy notice you have prepared in Wihi and send it for archiving to opinnaytetyot@lapinamk.fi. Use “privacy notice” and the name(s) of the thesis author(s) as the subject of the message.
If you wish, you can attach it to your thesis. As the statement does not serve as a means of communication in this context, you can delete your contact information from it and only leave your name visible.
The privacy statement may also serve as a basis for the creation of information to be provided to data subjects. You can also use a form to inform research participants of the thesis related to your degree. In the form, you can give more detailed information about your thesis and key data protection issues.
You should ask for the consent to participate in the survey of anyone from whom information is collected. The consent to participate can be requested in writing, orally at the beginning of the interview or as an option to be selected in the survey.
With regard to consent, it is important that the study participant understands at a sufficient level what they are consenting to.
The template for consent can be found here.
The consent form can be signed electronically in AtomiSign. Instructions for signing can be found in the AtomiSign student guide. Electronically signed consent forms are stored in Wihi.
If the subject withdraws their consent, in terms of the study this means that the identifiable data must be deleted.
Personal data should not be included in the completed thesis without a reason. The material must be anonymised or pseudonymised.
Anonymisation means the processing of personal data in such a way that the person can no longer be identified from them. Personal data can be deleted from the information, and data about an individual person will no longer be in identifiable form.
Identification must be prevented irrevocably and in such a way that the controller or any other external party can no longer make the data identifiable again with the information in its possession.
Pseudonymisation means the processing of personal data in such a way that the personal data can no longer be linked to a specific person without further information. Such additional information must be stored carefully, separate from the personal data.
Even if the information is pseudonymised, it can still be used to identify an individual by combining additional information. Pseudonymised data remains personal data and must be processed in accordance with data protection provisions.
Ensuring information security
Store the material in a safe place and ensure adequate protection. If personal data is lost or becomes available to third parties, this constitutes a security breach.
If you suspect that this has happened, please notify the data controller immediately or send an email to tietosuoja@lapinamk.fi for further instructions.
You have a duty of confidentiality concerning any confidential personal information you receive from a data subject, and you cannot discuss it with third parties.
The exception to this is the thesis supervisor, with whom you can go through the material, if necessary, because they are not external to your thesis.
3. Complete your research
4. When the thesis is completed
Taking care of the lifecycle of personal data is particularly important. After the survey, research material containing personal data must not be stored unnecessarily but must be disposed of (as a general rule) securely.
Material containing written personal data must not be placed in a paper collection or waste bin. The University of Applied Sciences has lockable data security rubbish bins where you can leave the material in question.
Files stored on a network drive or Webropol must be deleted, and other material must be disposed of securely.
Contact information for the Data Protection Officer of Lapland University of Applied Sciences:
Lapland University of Applied Sciences, Jari Rantala Tel. +358 40 547 2583 email: tietosuoja@lapinamk.fi
Useful links:
The processing of personal data is regulated by data protection legislation:
Other legislation may also contain provisions on the processing of personal data (specific legislation).
Website of the Data Protection Ombudsman
Scientific research and data protection
Publication of the Finnish Advisory Board on Research Ethics 3/2019 Ethical principles of human research and ethical review of human sciences in Finland
Lapland University of Applied Sciences’ privacy pages
Your thesis is working-life oriented and develops working life. If you do your thesis as a commission, you will collaborate with working life throughout the process. The party commissioning the study may be an external partner, Lapland University of Applied Sciences or one of its externally funded projects.
Before you start your thesis, you must prepare a written thesis agreement. The agreement sets out the key rules for the work. The agreement is prepared according to the instructions of the supervising teacher. Return the draft agreement to Wihi for review by the supervisor. The supervisor gives feedback on the agreement. If the agreement is in accordance with what was agreed, the supervisor will give you permission to send the agreement for electronic signature.
The thesis agreement form is selected according to the party commissioning the study.
Thesis agreements and instructions, as well as the general terms and conditions of the thesis agreement, can be found on the website.
Signing of the thesis agreement
Sign the thesis agreement electronically. Complete the agreement and send it via AtomiSign to all contracting parties. You can find instructions for electronic signing on the university’s website.
Once everyone has signed the agreement, you should download it from AtomiSign and save it to Wihi.
Send the agreement for archiving in Wihi to opinnaytetyosopimukset@lapinamk.fi by using the function for sending to an external party for comments. The subject of the message is thesis agreement and the name of your degree programme.
If you hand over your research material, or the rights to it, to the UAS, you must conclude a separate agreement.
Forms associated with the planning phase
Approval of the planning phase
You will receive an approved study credit for the planning period of the thesis (5 cr/10 cr), when: