(project_classification)=

# Project classification

> This task is the responsibility of {ref}`role_project_team`.

There are two steps to carry out at this stage:

- Complete the classification process for your project
- Complete Turing's Data Protection Assessment Process (DPAP)

## Complete the classification process for your project

Below are instructions to carry out the classification process.

1. You should now know who will be responsible for carrying out data ingress classification for your project. Ensure the right people (either the [Data Provider Representative (DPR)](https://data-safe-haven.readthedocs.io/en/v4.2.2/roles/data_provider_representative/), [Project Investigator](https://data-safe-haven.readthedocs.io/en/v4.2.2/roles/investigator) and [Referee](https://data-safe-haven.readthedocs.io/en/v4.2.2/roles/project_manager/project_lifecycle.html#stakeholder-identification) or the people they have delegated responsibility to) have carried out the classification process for the project using the flow diagram below.
   This involves them starting at the beginning, and answering the yes/no questions that follow until they arrive at a Tier level.
   The image below can be expanded by right clicking and selecting 'Open image in new tab'.

   > {{warning}} Note: classification is carried out on work packages (the datasets and the work to be done with them, for instance combining with other datasets), NOT the datasets alone

   ```{image} ../../../images/data_classification_updated.svg
   :alt: Data classification flow chart
   :align: center
   ```

2. Ensure agreement is reached as to the final classification.

3. Go to your SharePoint folder, and visit `project-initiation` -> `Turing TRE Project Initialisation`

4. Replace the red text with the the classification level arrived at above
   - **Role**: Delete as appropriate - depending on whether the role has been delegated
   - **Name**: Insert the name of the person signing off

```{warning}
- If your classification has come out at Tier 4, we cannot support this project due to the extremely high sensitivity level of the data.
- If your classification has come out at Tier 4, you should strongly consider the implications of carrying out a research project with this data.
```

## Complete Turing's Data Protection Assessment Process (DPAP)

You also need to complete the Turing DPAP in consultation with the Turing Data Protection Team. This can be done by any designated member of the project team, though must ultimately be signed by the Contract Lead. See the [DPAP page on Mathison](https://mathison.turing.ac.uk/page/3026?SearchId=437641) for more information.

1. All information for the DPAP can be found in [this folder](https://thealanturininstitute.sharepoint.com/:f:/s/gc/EnZQ82lXglJPv_vjve1VTq4B5mVkcV2ibeId0PrLrjK4yQ?e=MaHFNo).

2. Complete the [DPAP Form](https://thealanturininstitute.sharepoint.com/:w:/r/sites/gc/_layouts/15/Doc.aspx?sourcedoc=%7B56DE3391-E9A7-46F4-BAFB-D0C5F79D539F%7D&file=DPAP%20Form.docx&action=default&mobileredirect=true&cid=c4f4ec2d-514e-4acd-9ffa-bbda1c368b18). All supporting forms and questionnaires can be found in the folder above.

3. Send a DocuSign document out to the relevant people as laid out in the form (including the Contract Lead and the Turing Data Protection Manager)

4. Save the signed document as a PDF in the `dpap` folder