Institutional Data is categorized into data classifications as defined in IT Policy DM-01: Management of Institutional Data to ensure proper handling and sharing of data based on sensitivity and criticality of the information. Data classifications are listed below from most sensitive to least sensitive:
Critical
Inappropriate handling of this data could result in criminal or civil penalties, identity theft, personal financial loss, invasion of privacy, and/or unauthorized access to this type of information by an individual or many individuals.
Restricted
Because of legal, ethical, or other constraints, this data may not be accessed without specific authorization, or only
selective access may be granted. Any identifiable data, including contact information and bio-demographics about students or employees, is assigned restricted data classification.
University-Internal
Data that may be accessed by eligible employees and designated appointees of the university conducting university business. This data classification does not include access by students unless they are also employed or appointed by the university.
Public
Few restrictions; generally releasable to a member of the public upon request. Upon receipt of a request, seek advice from the appropriate data steward. If the request is made pursuant to the Indiana open records statute, seek advice from the Office of the VP and General Counsel, as well as the appropriate data steward.
For detailed information, use the Data Sharing and Handling (DSH) tool. This tool identifies how data have been classified, where it should be stored, and what laws and regulations should be considered. It also provides general guidance for sharing and disposing of each type of data. The tool is a simple 2 step process:
For more background information, see: What is institutional data?
If you have more specific questions about data classification or the appropriate use of your data, after reviewing the content in the DSH tool, please contact the appropriate Data Steward. If you would like more complete information on data classification by domain, see the Data Classification Matrix.
The following chart shows examples of how some data is classified within each data domain.
| Domain | Critical | Restricted | University-Internal | Public |
|---|---|---|---|---|
| Cross-domain identifiers (PII) | SSN, Biometrics (finger and voice prints, facial scans) | Last 4 digits of SSN | University ID numbers | Username |
| Student | Driver’s license, passport, credit card or banking information, CrimsonCard magstripe, loan/FAFSA data | Individual grades, academic transcript, class schedule, date of birth, advising notes, CrimsonCard barcode | Student name, Major, Degree | |
| Human Resources | I-9 Form data; Payroll direct deposit account number | Employee home address, CrimsonCard barcode | Employee offer letters, faculty tenure recommendations | Employee name and compensation |
| Health | Patient record | Faculty/Staff Immunization record | ||
| Facilities | Detailed floor plans showing gas, water, sprinkler shut-offs, hazardous materials | Basic floor plans showing egress routes and shelter areas | Campus map showing buildings, names, addresses, parking, lighted pathways, emergency phones, etc. | |
| Finance | FAFSA data, loan disbursement data, delinquent account or collection, Treasury (electronic claims) | Tax deductions or contributions | Capital asset data, chart of accounts, Budget | |
| Research | Images, audio recordings, and video recordings of human research participants | Licensed data or external data with restrictions documented in the data agreement | Open government data used for research purposes at IU |
