UW System Administrative Policy Guidance 1031
Guidance for SYS 1031: Information Security: Data Classification

Data Classification Examples

Original Issuance Date: December 1, 2023
Last Revision Date:  December 1, 2023
Effective Date: December 1, 2024 

1. Purpose of Guidelines 

These guidelines provide a list of data classification examples. 

2. Publishing Office(s) 

UW System Office of Information Security 

3. Affected Stakeholders on Campus 

This guidance is applicable to all UW System institutions, including UW System Administration. In particular, this guidance applies to those who are responsible for classifying and protecting institutional data. 

4. Primary Responsibility 

Data Stewards responsible for overseeing the lifecycle of one or more data domains and principal investigators overseeing one or more sets of research data should use the following data classification examples to guide their data classification efforts and classify data in a consistent manner. 

5. Guidelines  

Data classification should be applicable to a data set, depending on its intended use and its combination with other data. Data Stewards need to use their best judgment when choosing how to classify data as data sets, at times, may fall into a higher data classification depending on the situation. 

The following are examples of data sets and, where appropriate, data elements expected to fall within each data classification. This list is non-exhaustive. 

A. Public (Low Risk) 

  1. University websites, maps, or brochures intended for public use 
  2. Course catalogs and timetables 
  3. Degree program requirements 
  4. Directory information 
  5. University approved press releases 
  6. Final budget data 
  7. Published research data 

B. Internal (Low Risk) 

  1. Course evaluation summary results for a program or department 
  2. Draft, preliminary, and unofficial Budget data 
  3. Funding strings, purchase requisitions, and purchase orders 
  4. Facility-, floor-, and space-level data including facility and room square footage, organizational assignments, space use, and function  
  5. Data elements that are not covered by specific regulation but can be used to uniquely identify an individual and that the individual or university policy does not allow for public disclosure 

C. Sensitive (Moderate Risk) 

I.  Student Educational Records regulated by FERPA

Non-Directory student data subject to the Family Educational Rights and Privacy Act (FERPA), including: 

    1. Graded work, grade book, etc. 
    2. Name and preferred name 
    3. Date of birth 
    4. Place of birth 
    5. Directory address and phone number 
    6. Electronic mail address 
    7. Mailing address 
    8. Campus office address (for graduate students) 
    9. Secondary mailing or permanent address 
    10. Residence assignment and room or apartment number 
    11. Dates of attendance, i.e. specific semesters of registration 
    12. Enrollment status 
    13. UW degree(s) awarded and date(s) 
    14. Major(s), minor(s) and field(s) 
    15. University degree honors 
    16. Institution attended immediately prior to UW 
    17. ID card photographs for university classroom use 
    18. Student Identifier (unique identifier for all students) 
    19. College and class 
  2. II.  Student Directory Opt-Out Data 
  3. Note that the following data may ordinarily be revealed by the university for Directory Information purposes without student consent unless the student designates otherwise. If the student designates otherwise, then the following data elements must be treated as Sensitive data: 
    1. Name and preferred name 
    2. Directory address and phone number 
    3. Dates of attendance, i.e. specific quarters or semesters of registration 
    4. Enrollment status, i.e. college, class (fresh, sophomore, etc…) 
    5. UW degree(s) awarded and date(s) 
    6. College and class 
    7. Major(s), minor(s) and field(s) of study 
    8. University degree honors and awards management data 
    9. Faculty and staff reviews and performance evaluations 
  2. III.  Research data not otherwise classified
  3. IV.  Research protocols containing proprietary information

D. Restricted (High Risk) 

  1. Information that must be reported to the state if disclosed, according to Wis. Stat. § 134.98 
  2. Personal Information 

Personal Information that consists of an individual’s last name, and the individual’s first name or first initial, in combination with and linked to any one or more of the following data elements: 

    1. Social Security number or partial Social Security number 
    2. Driver’s license number 
    3. State identification card number 
    4. Passport number 
    5. United States Permanent Resident Card or similar identification 
    6. Student Identifier 
    7. Financial account number 
    8. Credit/debit card number 
    9. Unique biometric information, including:  
      1. DNA or deoxyribonucleic acid profile, as defined in Wis. Stat. § 939.74(2d)(a) 
      2. Fingerprint, voice print, retina or iris image 
      3. Any other unique physical representation 
  2. III.  Protected Health Information (PHI) regulated under the Health Insurance Portability and Accountability Act (HIPAA) 
    1. Patient names 
    2. Street address, city, county, zip code 
    3. Dates (except year) related to an individual (e.g. clinical encounters) 
    4. E-mail, URLs, & IP addresses 
    5. Social Security numbers or partial Social Security numbers 
    6. Account/Medical record numbers  
    7. Health plan beneficiary numbers 
    8. Certificate/license numbers 
    9. Vehicle IDs & serial numbers 
    10. Device IDs & serial numbers 
    11. Biometric identifiers 
    12. Full face images associated with HIPAA records 
    13. Payment guarantor’s information 
    14. Any PHI not de-identified per the Safe Harbor De-Identification method listed in the university HIPAA Policy 
  2. IV.  Employee Information 

Information pertaining to employees of UW System, including the following data elements: 

    1. Social Security number or partial Social Security number 
    2. Direct deposit information 
    3. Home address or personal contact information 
    4. Benefits information 
    5. Worker’s compensation or disability claims 

V. Legal Information 

VI.  Student Educational Records (FERPA) 

FERPA Restricted Non-Directory Data 

    1. Transcripts 
    2. Student financial services information 
    3. Credit card numbers/Bank account numbers/Debit cards numbers 
    4. Birth name is Restricted if a preferred name is selected 
    5. Wire transfer information 
    6. Payment history 
    7. Financial Aid/Grant information 
    8. Student tuition bills 

VII.  General Data Protection Regulation (GDPR) 

Personal Data protections apply to European Union residents, permanent or temporary, regardless of citizenship. Includes any information relating to an identified or identifiable person (data subject). Applies to all individuals regardless of student or employee status. Applies to all data that alone or in combination identifies a person directly or indirectly, including but not limited to: 

    1. An identification number such as a passport, national ID, or driver’s license number 
    2. Location data such as home address 
    3. An online identifier such as email or IP address 
    4. Any data specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a person such as a photo, social media profile, political opinions, or religious beliefs 

VIII.  Donor Information 

    1. Name 
    2. Credit card numbers/Debit card numbers 
    3. Bank account numbers 
    4. Social Security numbers or partial Social Security numbers 
    5. Amount/what donated 
    6. Telephone/Fax numbers 
    7. Employment information 
    8. Family information(spouse(s)/children/grandchildren) 
    9. Medical history 

IX.  Housing Data 

    1. Name when in combination with: 
      1. Credit rating/history 
      2. Financial worth; Income levels and sources, etc. 
  2.  X.  Research Information 
    1. Lab animal care information 
    2. Proprietary data as classified by an industry sponsor 

XI.  UW proprietary or 3rd party information 

XII.  Business Information 

    1. Credit card numbers; Bank account information 
    2. Proprietary data covered by confidentiality or non-disclosure agreements such as but not limited to: Contracts or proposals; project specifications; proprietary company data; models, figures, illustrations. 
    3. Purchasing card (P-card) numbers 
    4. Social Security or other taxpayer ID numbers 
    5. Contract information (between UW and third parties) 

XIII.  Federal Information Security Management Act (FISMA) Data  

XIV.  Controlled Unclassified Information (CUI) 

XV.  Export Controlled Research Information 

    1. Any information labelled Export Controlled or ITAR USML Category or EAR CCL ECCN or any DoD Distribution Statement other than A. 
    2. Information or technology subject to the authorization requirements of 10 CFR part 810, or Restricted data as defined in section 11 y. of the Atomic Energy Act of 1954, as amended, or of other information, data, or technology the release of which is controlled under the Atomic Energy Act and regulations therein. 
    3. Proprietary or 3rd Party information not in the public domain or being published, must be protected until an export classification determination is complete. 

XVI.  Data Posing a Threat to Health and Safety 

    1. Bio Toxins 

6. Contact 

Institutional Data Stewards, Principal Investigators 

7. Guideline History 

Original Issuance: December 1, 2023 

8. Scheduled Review 

December 2028