The saying “Well begun is half done” also applies to your thesis. Planning the work carefully will help you complete the thesis process. The planning phase proceeds as follows:
Once the supervisor has approved the completed part, 5 out of 10 credits will be registered in Peppi for the planning phase.
All the communication related to the theses takes place in a single system, Wihi:
There are three roles in Wihi:
Coordinator
Supervisor
Student
The thesis consists of three phases, with a scope of 5 credits (ECTS) in a UAS bachelor’s degree and 10 credits (ECTS) in a UAS master’s degree. There are separate instructions for each phase:
The topic proposal is a preliminary plan for your thesis, in which you explain what you plan to do, why, how and when. Your thesis should relate to the core content of the study programme and the practices of the sector.
You will prepare a topic proposal for approval, as a basis for discussion in thesis group and to support your own work. Start your thesis process by making a topic proposal in Wihi. If there is more than one author, one of you should draft a proposal and invite the others to join. You can find more detailed instructions on how to create a topic proposal in the Wihi instructions.
Information to be added to the topic proposal:
Background information about the authors/author
Description of the thesis content, objective and result
Detailed description of the thesis content of the work, goal and desired outcome. Explanation of what the outcome of the thesis will be in practical terms. In the case of a diary-type thesis, the main tasks are described here.
Description of the significance, utilisation of the thesis results
Explanation of who needs the result and for what purpose, as well as the benefits during the use of the finished result. In the case of a diary-type thesis, a description of the key competences is required.
Planned tools
Planned working methods
Commissioner information (may be preliminary)
Abilities
The possibilities of the student to carry out the proposed work. A list of advanced professional studies completed by the student before starting the thesis, at least the RDI studies supporting the suggested thesis. Any other studies or work experience that support the thesis.
Approval of the topic proposal
Submit your topic proposal to Wihi for approval. If there are multiple authors, you cannot submit a proposal until everyone has accepted the invitation in Wihi.
The thesis coordinator will review your proposal and, if necessary, provide feedback for further development. Once the proposal meets the agreed requirements, the coordinator will approve it and appoint at least one supervisor for your thesis.
You must present your topic according to your degree programme instructions. Once your topic proposal has been approved, you will be allowed to start working on your thesis.
During the planning phase, you prepare a plan for your thesis, in which you describe the background, purpose, objectives, approach, methods, implementation, evaluation, ethical aspects, schedule and possible costs. If there is more than one author, agree on the division of tasks.
Prepare a plan by using the thesis template and submit it in Wihi to the supervisor(s) for comments.
Structure and content of the thesis plan
Describe the implementation schedule of the thesis and the resources that are required to carry out the thesis.
A data management plan is drawn up as an appendix to the thesis plan, with a view to ensuring that data is collected, analysed and stored in accordance with data protection requirements in connection with the thesis work.
The goal is also to ensure that ethical aspects are taken into account in the thesis. The data management plan describes how the data will be acquired, how it will be used, where it will be stored, how it will be retained, and what will happen to the data when the thesis is completed.
The data management plan is prepared by using a template prepared by Arene, which can be found here. You can also watch the attached video on the preparation of the plan.
During the planning stage of the thesis, at the latest when preparing the data management plan, it is good to consider whether you process or collect personal data in your thesis. The purpose of data protection legislation is to create a legal framework for the processing of personal data.
As a general rule, if your thesis relates to living persons, you are collecting or processing personal data. Data protection regulation also applies to published personal data such as personal data collected online. Data protection provisions do not apply to the processing of previously anonymised data.
Personal data
Personal data is defined in the EU’s General Data Protection Regulation (2016/679) as follows: “personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person”.
Personal data refers to any information that relates to an identified or identifiable person.
According to the Office of the Data Protection Ombudsman, personal data includes:
Personal data can enable direct or indirect identification.
Examples of personal data that allow direct identification include:
Personal data that allows indirect identification includes:
In the processing of personal data, it should be noted that a person is almost invariably identifiable by combining various indirect or secondary personal data. The more data available, the easier it is to identify a person.
The processing of personal data is defined in the GDPR as follows:
“‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction”.
For example: if you save a survey respondent’s name or if the respondent can be identified later, you are processing personal data.
Personal data in surveys and interviews
Personal data can be collected in a variety of ways, such as through questionnaires, interviews, observation, or by gathering personal data from online services.
Even in a survey conducted anonymously, personal data are processed if the respondent can be identified from the collected information, either directly or indirectly.
A person may also be identifiable based on the background information collected about them (e.g., age, gender, education, place of residence, professional title, or workplace).
If you are conducting a survey or interviews and cannot determine in advance whether the answers will generate personal data, you should assume that you are processing personal data.
The starting point of statistical research is that groups with fewer than five respondents should not be analysed separately. Therefore, even if your survey includes the only 68-year-old male midwifery student as a respondent, you must ensure that the analysis obscures any possibility of identifying that individual, so that no person can be distinguished in the final thesis. This should also be communicated to respondents in advance.
Always specify the source of contact information
If you have received a list of contacts from the thesis supervisor, you can use them to contact people.
However, when you contact someone, inform them immediately of the source of the contact information. It is also recommended to agree with the supervisor that you will destroy the data when you no longer need it. You must not store the information in your email or other personal files.
Photos and videos
If you use photos of an individual person in your thesis, obtain their consent. If you are taking photos at an event and the photo shows several people, it is a good idea to announce that you will take photos during the event that may be published in the thesis. It is recommended to give participants the chance to avoid the camera.
Photographing children is not allowed for theses.
Personal data obtained from public sources
Be careful when processing personal data obtained from public sources. Examples of public sources include court cases.
In such cases, note that even if a person’s information is publicly available somewhere, you must have grounds for including it as is in your thesis.
If the person in question holds or has held a public office, you may also use the information publicly; however, if the person is a private individual and there is no particular need to mention their name, it is best to avoid doing so.
For example, if you are referring to a court case, even if the Supreme Court documents show the name of the person whose case has been processed, you can refer to the case and the person, e.g. with the letter X.
You can still refer to publications using the author’s name, and this does not require any special measures in terms of data protection.
Sensitive personal data
Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership.
Sensitive personal data also includes health data as well as genetic and biometric data.
The processing of sensitive personal data for theses is, in principle, prohibited in accordance with the data protection policy of the Lapland University Consortium.
Processing of sensitive personal data as part of studies leading to a degree is, in principle, prohibited and allowed only in exceptional cases. Examples of such special exceptions are studies that absolutely require the processing of sensitive personal data. 2. If your research task involves the processing of personal data, clarify your role and responsibilities in relation to the processing of personal data
Data controller
‘Controller’ refers to an entity that alone or jointly with others determines the purposes and means of the personal data processing.
Therefore, the data controller is the party for whose purposes the personal data is processed and who makes the decisions concerning the processing of personal data.
The data controller is responsible for ensuring that the processing is carried out lawfully and appropriately, respecting the rights of the data subject.
For theses at Lapland UAS, the data controller is the student together with the UAS unit responsible for the field.
The university of applied sciences is represented here by the thesis supervisor. In some cases, the controller may be a commissioning or partner organisation.
Processing of personal data
Data processor means any natural or legal person, public authority, agency or other body which processes personal data on behalf of the data controller.
In that case, the data controller is another party and the data processor processes personal data on behalf of the data controller. For example, a person providing marketing services may be a processor of personal data when receiving customer name and contact information from the data controller.
In that case, there must be a written agreement between the data controller and the data processor regarding the processing of personal data. The data processor is also partly responsible for the processing of personal data, but their responsibility is more limited.
The processing of personal data must always have a legal basis, which must be determined before the processing begins.
It is not possible to change the grounds later. The grounds for processing affect the rights of the data subjects in relation to the data controller.
Theses for UAS degrees are usually based on the subject’s consent. The basis may be the controller’s legitimate interest when a thesis is based on registry data.
Provision of information to a study subject and consent
If you process personal data, you must inform the data subject. No provision is made for a specific form of notification channel (e.g. a privacy policy), but as a general rule the information must be provided in writing.
This allows you to take care of the data controller’s accountability, which means that the data controller must be able to demonstrate compliance with data protection legislation.
The template of the Privacy Policy can be found here. tähän tulee linkki
The privacy statement you have prepared will remain with you and, if necessary, you can use it to demonstrate compliance with the data protection legislation.
If you wish, you may attach it to your thesis. As the statement does not serve as a means of communication in this context, you may remove your contact details and leave only your name visible.
The privacy statement may also serve as a basis for the creation of information to be provided to data subjects. You can also use a form to inform research participants of the thesis related to your degree. In the form, you can give more detailed information about your thesis and key data protection issues.
You should obtain consent from all participants in the survey from whom information is collected. The consent to participate can be requested in writing, orally at the beginning of the interview or as an option to be selected in the survey.
With regard to consent, it is important that the study participant has sufficient understanding of what they are consenting to.
The template for consent can be found here.
If the subject withdraws their consent, in terms of the study this means that the identifiable data must be deleted.
Personal data should not be included in the completed thesis without a reason. The material must be anonymised or pseudonymised.
Anonymisation means the processing of personal data in such a way that the person can no longer be identified from them. Personal data can be deleted from the information, and data about an individual person will no longer be in identifiable form.
Identification must be prevented irrevocably and in such a way that the controller or any other external party can no longer make the data identifiable again with the information in its possession.
Pseudonymisation means the processing of personal data in such a way that the personal data can no longer be linked to a specific person without further information. Such additional information must be stored carefully, separate from the personal data.
Even if the information is pseudonymised, it may still be used to identify an individual when combined with additional information. Pseudonymised data remains personal data and must be processed in accordance with data protection provisions.
Ensuring information security
Store the material in a safe place and ensure adequate protection. If personal data is lost or becomes available to third parties, this constitutes a security breach.
If you suspect that this has happened, please notify the data controller immediately or send an email to tietosuoja@lapinamk.fi for further instructions.
You have a duty of confidentiality concerning any confidential personal information you receive from a data subject, and you cannot discuss it with third parties.
The exception to this is the thesis supervisor, with whom you can go through the material, if necessary, because they are not external to your thesis.
Managing the lifecycle of personal data is particularly important. After the study, research material containing personal data must not be stored unnecessarily and must, as a general rule, be securely disposed of.
Material containing written personal data must not be placed in a paper collection or waste bin. The University of Applied Sciences has lockable data security rubbish bins where you can leave the material in question.
Files stored on a network drive or Webropol must be deleted, and other material must be disposed of securely.
Contact information for the Data Protection Officer of Lapland UAS:
Lapland University of Applied Sciences, Jari Rantala Tel. +358 40 547 2583 email: tietosuoja@lapinamk.fi
Useful links:
The processing of personal data is regulated by data protection legislation:
Other legislation may also contain provisions on the processing of personal data (specific legislation).
Website of the Data Protection Ombudsman
Scientific research and data protection
Publication of the Finnish Advisory Board on Research Ethics 3/2019 Ethical principles of human research and ethical review of human sciences in Finland
Lapland University of Applied Sciences’ privacy pages
Your thesis is working-life oriented and develops working life. If you do your thesis as a commission, you will collaborate with working life throughout the process. The party commissioning the study may be an external partner, Lapland UAS or one of its externally funded projects.
Before you start your thesis, you must prepare a written thesis agreement. The agreement sets out the key rules for the work. The agreement is prepared according to the instructions of the supervising teacher. Submit the draft agreement to Wihi for review by the supervisor. The supervisor gives feedback on the agreement. If the agreement is in accordance with what was agreed, the supervisor will give you permission to submit it for electronic signature.
The thesis agreement form is selected according to the party commissioning the study.
Thesis agreements and instructions, as well as the general terms and conditions of the thesis agreement, can be found on the website.
Signing of the thesis agreement
Sign the thesis agreement electronically. Complete the agreement and send it via AtomiSign to all contracting parties. You can find instructions for electronic signing on the UAS website.
Once everyone has signed the agreement, you should download it from AtomiSign and save it to Wihi.
Submit the agreement for archiving in Wihi to opinnaytetyosopimukset@lapinamk.fi by using the function for sending documents to an external party for comments. The subject of the message is thesis agreement and the name of your degree programme.
If you hand over your research material, or the rights to it, to the UAS, you must conclude a separate agreement.
Forms associated with the planning phase
Approval of the planning phase
You will receive an approved study credit for the planning period of the thesis (5 cr/10 cr), when: