Data Classification and handling
Every piece of Purdue data carries responsibility. Learn the classifications, the rules and your role in keeping it secure.
Purdue employees handle a wide range of information every day. How that information is stored, shared and protected depends on how it’s classified. This training content is required for the annual Data Handling Web Certification — including the laws that govern data security at Purdue, how data is classified and your responsibilities.
Why Data Security Matters
Purdue is bound by federal regulations including HIPAA, FERPA and GLBA. Failure to follow these rules can result in fines or penalties for the university. But compliance isn’t the only reason data security matters — it’s also about protecting the real people whose information we handle.
Risks of Mishandling Data
- Identity theft and fraud: Stolen personal information can take significant time and money to resolve.
- Personal safety: Some individuals restrict their directory information for serious safety reasons.
- Reputation: When data is compromised, required notifications and media coverage can harm the university’s standing.
Remember the golden rule to handle someone else’s data the way you’d want your own handled.
Laws and Policies
Federal Law
Family Educational Rights and Privacy Act of 1974 (FERPA)
The Family Educational Rights and Privacy Act (FERPA) defines students’ rights over their education records and outlines when and to whom those records can be disclosed.
Examples of FERPA-protected data:
- Grades, transcripts and degree information
- Class schedules
- Student information files, including demographic information
Faculty and staff who handle this data must complete required certification through Purdue WebCert.
Gramm-Leach Bliley Act (GLBA)
The Gramm-Leach Bliley Act (GLBA) protects personally identifiable information (PII) when a consumer provides that information to receive a service.
Examples of financial services at Purdue covered by GLBA:
- Student loans
- Information on delinquent loans
- Check cashing services
Faculty and staff who handle this data must complete the required certification through Purdue WebCert.
Health Insurance Portability and Accountability Act of 1996 (HIPAA)
Health Insurance Portability and Accountability Act (HIPAA) requires Purdue to protect the privacy and confidentiality of health information.
Examples of protected health information:
- Past, present or future physical or mental health conditions
- Provision of health care
- Past, present or future payment for health care that identifies an individual (name, address, Social Security number or birth date)
Additional departmental HIPAA training may be required depending on your role. Complete required certification through Purdue WebCert.
State Law
Indiana SSN Disclosure — Indiana Code § 4-1-10
Indiana law prohibits state agencies from disclosing an individual’s Social Security number (SSN) except in specific circumstances.
Disclosure is permitted only when:
- The person gives written or electronic consent
- Required by federal or state law
- Administering employee health plan benefits
- Required by the U.S. Patriot Act
- Sharing internally or with another state, local or federal agency
- Sharing with a contractor who needs the SSN to provide goods or services (contractual safeguards required)
- Sharing with a contractor for purposes permitted under HIPAA or FERPA
Important: If a disclosure is made impermissibly, criminal penalties apply to the employee who made the disclosure — not just the university.
Notice of Security Breach — Indiana Code § 4-1-11
If Purdue discovers that unencrypted personal information may have been accessed by an unauthorized person, Indiana law requires prompt written notification to any affected state residents.
Under this law, “personal information” means a person’s full name or first initial and last name, combined with at least one of the following:
- SSN
- Driver’s license or state ID number
- Financial account number, credit or debit card number, security code, access code or password
Notification must be made without unreasonable delay and, in most circumstances, in writing.
Purdue Policy
Data Classification and Governance
Every piece of data Purdue owns, uses or maintains must have a designated information owner. Working with the relevant data steward, that owner classifies data into one of three risk levels: Public, Sensitive or Restricted. Classifications are reviewed periodically based on how the data is used, how sensitive it is and how important it is to the university, in compliance with applicable law.
Social Security Number (SSN)
Purdue doesn’t use Social Security numbers (SSNs) as system identifiers. New systems won’t be built around SSNs, and forms that collect SSNs must indicate whether providing one is voluntary or mandatory. Unless legally required, you should use a person’s Purdue University identification number (PUID) instead.
Data Security and Access Policy (C-34)
This policy applies to all administrative and academic computing resources and is guided by three principles:
- Access: Employees should have access to the data they need to do their jobs.
- Data Security: Prevent unauthorized access to systems, data, facilities and networks.
- Physical Security: Prevent misuse of or damage to computer assets or data.
The policy is clear — having access to data doesn’t mean you can browse it freely. Access is only for completing your assigned job functions, and supervisors share this responsibility.
IT Resource Acceptable Use
Only access files or data that belong to you, are publicly available or that the data owner has authorized you to access. Don’t use Purdue IT resources for outside business, political activity or personal gain.
Purdue email accounts are for university business. Messages sent or stored on university systems may be considered public records under the Indiana Public Records Act. Use caution — don’t send confidential information by email. Don’t use email to harass, threaten or demean others, or for commercial or political purposes.
For a complete list of university policies, visit the Purdue University Policy Office website.
Data Classification Categories
Public
Public data may be or must be open to the public. Examples include:
- Chart of accounts and pay scales
- The University Catalog
- Directory information
Note: Individuals may choose to restrict their own directory information.
Sensitive
Sensitive data is guarded due to privacy considerations. Examples include:
- Financial account balances
- Major program of study, admissions applications and decision letters
- PUID and date of birth
Restricted
Restricted data is protected by law, policy or regulation — or has been designated highly sensitive by Purdue. Examples include:
- Garnishments, credit card numbers, bank account numbers, grant proposals, employee counseling and discipline records, and I-9 documentation
- Student academic records, non-directory information and SSN
- Self-identification information including ethnicity, race, disability status and veteran status
Roles in Data Handling
Everyone at Purdue plays a role in protecting data. Three formal roles define these responsibilities.
Information Owners
Information owners provide policies and guidelines for the proper use of information, and may delegate interpretation and implementation to appropriate staff.
Data Stewards
Data stewards monitor access and usage of data for specific areas of the university (HR, IT, University Residences, Student Services, etc.). They’re responsible for facilitating compliance with data policies among their area’s staff.
Data Custodians
Every university employee is a data custodian — responsible for implementing data policies in day-to-day work and handling information securely at the individual level.
How to Handle Data
“Handling” means viewing, creating, updating, deleting, destroying or transferring data. Purdue’s handling guidelines are organized by how the data is transmitted.
I want to learn about
Printed Information
Printed Data (Paper, Microfiche or Microfilm)
| Action | Public | Sensitive | Restricted |
|---|---|---|---|
| Storage | No special requirements | No special requirements | Store in a secured location when not in use |
| Mailing | No special requirements | No special requirements | No classification markings on the outside of the envelope; seal so tampering would be visible upon receipt |
| Labeling/copying | No special requirements | No special requirements | Make copies only as required for distribution; recipients must not further distribute without permission |
| Disposal | No special requirements | Physical destruction beyond recovery (shredding); locked Physical Facilities blue recycle bins are acceptable | Same as Sensitive |
The university’s confidential recycling program is acceptable for all document classifications. Request recycling services through Physical Facilities.
Electronically Stored
Storing Restricted Data
- Don’t copy restricted data to removable media (USB drives, CDs or external hard drives). If there’s a genuine business need, consult your supervisor and data steward first.
- Don’t store restricted data on your C:\ drive or any individual workstation hard drive.
- Best practice: Store restricted data on a secure, password-protected server with proper access controls and backups.
- Archiving: Restricted data must be encrypted and stored in a physically secured location.
- Don’t store restricted data on a home computer or personal device.
Electronically Transmitted
Printing Restricted Data
- Pick up printouts immediately.
- Unattended printing is acceptable only when physical access controls are in place (for example, a printer in a locked room or unit accessible only to a small, known group).
Transmitting Restricted Data
Transmitting includes email, instant messaging, fax, FTP, voicemail and scanning.
- Don’t email files containing restricted data unless the email is encrypted or you use a secure file transfer method. Purdue’s Filelocker service is an approved secure transmission option.
- Don’t use cellular or wireless technology to transmit restricted data.
- Faxing restricted data is only permitted to secure machines with limited access, and the recipient must be notified in advance.
- Don’t leave restricted data in a voicemail message. Ask the recipient to call you back.
Data Destruction
Improper disposal is one of the most common causes of unintentional data exposure. All Purdue data — regardless of classification — must be properly destroyed when no longer in use.
- Removable media (USB drives, CDs and external hard drives) that ever contained Purdue data must be physically destroyed when no longer needed at the university.
- Fixed media (hard drives, servers and storage devices) that ever contained Purdue data must be physically destroyed when no longer needed.
- Purdue’s Recycle for the Future program is an approved disposal option for electronic media. View Media Disposal Guidelines on SecurePurdue.
Questions to Ask Before You Handle Data
Before using, sharing or storing data, ask yourself:
- What type of data is this, and how is it classified? Use extra caution with personal details, financial information, SSNs and PUIDs.
- Who will have access to it, and what will they do with it?
- What do the handling requirements say for this classification?
- Have I followed the appropriate guidelines for Public, Sensitive or Restricted data?
- Is there a more secure way to handle this information?
If you’re unsure, ask your supervisor or your area’s data steward.
Top 10 Data Security Tips
1. Use strong, secret passwords: Follow Purdue’s password policies and guidelines. Review Purdue’s password standards.
2. Never log in for someone else: Don’t log in to Purdue computer systems, email or mobile devices on another person’s behalf.
3. Don’t save passwords on devices: Don’t store passwords on your workstation, in email, or on a phone or mobile device.
4. Lock your workstation when you step away: Lock even when taking a short break. On Windows, use Ctrl+Alt+Delete and select “Lock Computer.”
5. Log off or shut down each night: Check with departmental IT staff for the recommended procedure in your area.
6. Ignore unsolicited requests for account information: Never provide personal or account information in response to an email or phone call you didn’t initiate.
7. Be cautious with unexpected attachments: Don’t open or download attachments you weren’t expecting. Contact the sender to verify before opening.
8. Turn off browser autocomplete: Autocomplete can store usernames and passwords. Ask your departmental IT staff for help disabling it.
9. Don’t download unauthorized software: Software, screensavers, fonts and games from untrusted sources can contain viruses or create security vulnerabilities.
10. Stay current on security best practices: Review IT security policies and best practices on Secure Purdue.
Never change security settings on your computer without consulting your departmental IT staff first. The same rule applies to multifunction copier/scanner/fax machines. If you wouldn’t email a document containing that information, don’t scan and email it to yourself from the machine.
Quick Reference Summary
- Only access data needed to complete your assigned job function.
- Use PUID instead of SSN whenever possible.
- Employees can be held personally responsible for impermissible SSN disclosures.
- Handle HIPAA, FERPA and GLBA data with special care.
- Purdue has three data classification levels: Public, Sensitive and Restricted.
- PII, public records and “confidential” are not data classification levels.
- Email may be considered a public record.
- Everyone is a data custodian.
- Data handling guidelines depend on how data is transmitted: printed, electronically stored or electronically transmitted.
Submitting a Data Request
The Institutional Data Analytics and Assessments (IDA+A) team manages data for the university. Use the IDA+A project request form to submit requests for:
- Student data
- Direct student emails
- Banner loads for advisors, student attributes and cohorts
Email the IDA+A team with questions at idata@purdue.edu.
Quick Links to University Resources
