Office of the CIO

Queen's University
Search Type
Office of the CIO and Associate Vice-Principal (Information Technology Services)
Office of the CIO and Associate Vice-Principal (Information Technology Services)

Data Classification Scheme

Data classification is one of the building blocks for information security at Queen’s University. Data owners and custodians need to classify data within their domain of responsibility to ensure the level of information protection and privacy is commensurate with the sensitivity and value of that data. The purpose of this document is to establish a data classification framework to guide members of the Queen’s community in using and managing data and information in both hardcopy and electronic format. Compliance with University policy and federal and provincial legislation, such as FIPPA and PHIPA, is an additional goal for a University data classification scheme.

Data Classification Categories

 

Restricted

Confidential

Internal

Public

Definition

Information that is highly sensitive and intended to be used by a small, limited number of authorized individuals on a need-to-know basis.

Information that is personal and/or sensitive and intended to be used by authorized individuals for an authorized purpose on a need-to-know basis. 

Information that is intended to be used internally in the day-to-day operations of the University or a department.

Information that Queen’s has published for general or public consumption, or publicly known information that Queen’s has received from other organizations.

Examples

  • Certain security response plans
  • Some IT technical data about networks and systems
  • Locations of hazardous material storage and animal care facilities
  • Personal information including name, gender, date of birth, Social Insurance Number, student number, home address and phone number
  • Personal health information
  • Employment records including employee number
  • Information about students, including grades
  • Donor or prospect information
  • Unpublished research data and intellectual property
  • Contracts and other legal documents and material
  • Internal audit reports and working papers
  • Drafts of strategic plans, annual reports and financial statements
  • Administration procedures
  • Draft marketing information
  • Vendor or service provider contracts
  • Internal communications regarding projects, etc.
  • Departmental policies and procedures
  • Floor plans, access codes, etc.
  • Employee lists
  • Teaching material
  • Planning documents

 

  • Queen’s and departmental websites
  • Brochures, campus maps, etc.
  • Published marketing information
  • Course descriptions
  • Published annual reports, strategic plans and financial statements
  • Queen’s policies
  • Employee business contact information (telephone, email, etc.)

 

 

 

Risk Impact

  • Significant risk to personal safety
  • High potential of liability (civil & criminal)
  • Significant loss of reputation
  • High degree of inconvenience if corrupted or modified
  • Potential risk to personal safety
  • Loss of personal or individual privacy
  • Loss of intellectual property
  • Negative impact on funding and commercial interests
  • Significant potential of financial consequences
  • Significant potential of legal liability
  • Loss of reputation
  • Disruption to business if information not available
  • Low degree of risk if information corrupted or modified
  • Minimal potential liability
  • Minimal financial consequences

 

  • Little or no impact to individuals or University
  • Some reputational risk if publicly facing information is modified by unauthorized persons (e.g., website vandalized)
  • Minimal inconvenience if not available

 

Who has access to read?

  • Named individuals designated by the Information Steward.
  • Access must be revoked immediately when named individuals leave the University or the custodial unit.

 

  • Access is limited to individuals in a specific function, group, or role.
    • Principle of least-privilege and need-to-know must be applied regarding University employees.
    • Access must be revoked immediately when users leave the University or the custodial unit.
  • Access is limited to employees and other authorized users for business-related purposes.
  • Access must be revoked as soon as reasonably possible when users leave the University or the custodial unit.

 

  • No access restrictions

 

Who has authority to modify?

  • Named individuals designated by the Information Steward.
  • Access must be revoked immediately when named individuals leave the University or the custodial unit.

 

  • Access to modify is limited to individuals in a specific function, group, or role.
    • Principle of least-privilege and need-to-know must be applied regarding University employees.
      • Access to modify must be revoked immediately when users leave the University or the custodial unit.
  • Access to modify is limited to employees and other authorized users for business-related purposes.
  • Access to modify must be revoked as soon as reasonably possible when users leave the University or the custodial unit.

 

  • Access to modify is limited to individuals in a specific function, group, or role designated by the Information Custodian.

 

How to transmit by voicemail

  • Leave only name and contact details for call-back.
  • Leave only name and contact details for call-back.
  • For PI/PHI of call recipient, leave only name and contact details for call-back unless the individual has given prior consent to leave a message.
  • Ensure that details are not overheard by unauthorized individuals.
  • No special precautions required.

How to transmit by interoffice mail

  • Enclose in double envelope with the inner, sealed envelope labelled “Restricted” and the outer, sealed envelope labelled with recipient’s name.
  • For confidential information, enclose in a sealed envelope labelled “Confidential”.
  • For PI/PHI, enclose in a sealed envelope labelled “Personal and Confidential”.
  • Enclose in an inter-office envelope.
  • No special handling required.

How to transmit by postal mail

  • Use authorized courier service or registered mail only.
  • For sensitive PI and for all PHI, use authorized courier service or registered mail unless individual has given prior consent to use regular mail; otherwise, use regular mail.
  • Use regular mail.
  • No special handling required.

How to transmit by FAX

  • Avoid if possible.  Telephone before faxing to ensure recipient is waiting to receive the fax.  Call to confirm successful transmission.  Use coversheet labelled “Restricted”.
  • For confidential information, avoid if possible. 
  •  For PI/PHI, avoid unless individual has given prior consent.  Telephone before faxing to ensure recipient is waiting to receive the fax.  Call to confirm successful transmission.  Use coversheet labelled “Personal and Confidential”.
  • Take reasonable care in dialing; use a coversheet.
  • No special handling required.

How to transmit by email

  • Only by those designated by Information Steward and only with encryption.
  • Labelled “Restricted”.
  • Include “Read” receipt.
  • Double check the address before sending.
  • Encrypt.
  • For PI, emailing someone’s own information to them strongly discouraged unless individual has given prior consent.
  • Labelled “Confidential”.
  • Take reasonable precautions such as double-checking the address before sending.

 

  • No special handling required.

How to copy/print

  • Copying/printing can only be done with documented approval from the Information Steward.
  • Use secure print function.
  • Copying/printing to be minimized and only when necessary.
  • Use secure print function.

 

  • Use secure print function where warranted.
  • No special precautions required.

How to store in physical format

  • Store within a file cabinet or desk drawer that is locked at all times.  Ensure room is locked in an alarmed area in non-working hours.   

 

  • Stored within a file cabinet or desk drawer that is locked in non-working hours.  Ensure room is locked in an alarmed area in non-working hours.
  • Implement additional controls as necessary to comply with relevant legislation or other requirements.
  • Recommend to store within a file cabinet or desk drawer that is locked in non-working hours. 

 

  • No special safeguards required.

 

How to store in electronic format

  • Store within a controlled-access system (e.g., password protected file or file system, alarmed area).
    • Encryption mandatory on mobile devices and workstations, and strongly recommended in all environments.
    • Encryption mandatory for cloud storage.

 

Encryption Service

 

  • Store within a controlled-access system (e.g., password protected file or file system, alarmed area).
  • Encryption mandatory for PHI.
    • Encryption mandatory on mobile devices and workstations, and strongly recommended in all environments.
    • Encryption mandatory for cloud storage.

 

Encryption Service

  • Store within a controlled-access system (e.g., password protected file or file system).

 

 

  • No special safeguards required.

 

How to destroy

  • Securely shredded or erased in accordance with University guidelines:

Disposal of Data Storage Devices and Portable Media

Dispose of Records

 

  • Securely shredded or erased in accordance with University guidelines:

Disposal of Data Storage Devices and Portable Media

Dispose of Records

  • Securely shredded or erased in accordance with University guidelines:

Disposal of Data Storage Devices and Portable Media

Dispose of Records

 

  • Recycle