Data Classification and Handling Policy

1. All University employees and other covered individuals are responsible for:
   1. Understanding what constitutes Private or Public University information; and
   2. Managing Private or Public University information in a manner consistent with the criticality of and the requirements for confidentiality associated with the data in any form (electronic, documentary, audio, video, etc.) throughout the entire information lifecycle (from creation through preservation or disposal).
2. All University information whether at rest (i.e., stored in databases, tables, email systems, file cabinets, desk drawers, etc.) or in use (i.e., being: processed by application systems, electronically transmitted, used in spreadsheets, or manually manipulated, etc.) must be classified into one of the three data classification levels described in this policy by each unit or department that is the Custodian of Records for that information.
   1. Determining classification level should be done according to an assessment of the need for Confidentiality of the information.

      Confidentiality: Access to information must be strictly limited to protect the university and individuals form loss.

      Limiting access to authorized individuals/entities/devices ensures legal obligations are fulfilled and/or protects KU and its stakeholders from the disclosure of data which is sensitive in nature.

      Note: The appropriate classification of each data set is based on the classification of the most confidential data stored in the data set (e.g., the database, table, file, etc.), or accessed by systems or people. This is true even if the data set contains other information that would qualify for a lower level of protection if it were stored separately.

   2. The table below summarizes the Data Classification process. All individuals covered under this policy are required to handle University information per the procedural controls found at the Data Classification and Handling Procedures Guide.

      Level I – Confidential Protection	STOP! SPECIAL CARE IS REQUIRED
      Level II – Sensitive Protection	BE VERY CAUTIOUS
      Level III – Public Protection	PROCEED WITH AWARENESS

      • Level I – Confidential Information: High risk of significant financial loss, legal liability, public distrust, or harm if this data is disclosed. (Examples provided in Appendix 1: Data Classifications Levels I, II, and III, linked below).
      • Level II – Sensitive Information: Moderate requirement for Confidentiality and/or moderate or limited risk of financial loss, legal liability, public distrust, or harm if this data is disclosed. (Examples provided in Appendix 1: Data Classifications Levels I, II, and III, linked below)
      • Level III – Public Information: Low requirement for Confidentiality [information is public] and/or low or insignificant risk of financial loss, legal liability, public distrust, or harm if this data is disclosed. (Examples provided in Appendix 1: Data Classifications Levels I, II, and III, linked below)

Appendix 1: Data Classification Levels I, II and III

Data Classification and Handling Procedures Guide