Data Classification Guidelines

The Data Classification Chart can help you better understand regulations and policies governing Restricted and Private Data and determine where to store your files. The Data Classification Chart is not exhaustive or detailed, and regulations and services offered change over time. Also, though a service may be designated as permissible to store data, effort should be made to ensure the data is not compromised by utilizing encryption methods where possible. Please contact the Office of the CIO if you have any questions on secure data storage or the sharing of data with colleagues within or outside the University.

Data should be classified as Restricted when the unauthorized disclosure, alteration or destruction of that data could cause a significant level of risk to the University or its affiliates. The highest level of security controls should be applied to Restricted data. Restricted data is any data that contains personally identifiable information (PII) concerning any individual, as well as any data that contains PII that is regulated by local, state, or Federal privacy regulations.

Y - Permissible to Store Data

N - Not Permissible to Store Data

Data should be classified as Private when the unauthorized disclosure, alteration or destruction of that data could result in a moderate level of risk to the University or its affiliates. By default, all Institutional Data that is not explicitly classified as Restricted or Public data should be treated as Private data.  A reasonable level of security controls should be applied to Private data. Examples of some of the type of data included are: budgets, contract negotiations, and compensation.

Default classification of data

Any data that contains PII concerning any individual or that is covered by local, state, or Federal regulations is classified as restricted data by default. All other data is classified as Private data by default.