Data Classification

Use these criteria to determine which data classification is appropriate for a particular information or infrastructure system. A positive response to the highest category in any row is sufficient to place that system into that classification. E-mail should be classified by the data or information contained therein. For example, e-mails that relate to specifically identified students must be kept as confidential education records. Each user should protect their e-mails as required under PS-121-ST-3 (Applications Acceptable Use) and PS-124 (Data Management).

Note: If you are creating a new information system that will store or handle Confidential Data, you must inform the IT Security & Policy Office.


Data Type Legal Requirements Reputation Risk Other Institutional Risk Access Examples
Confidential Data Protection of data is required by law (i.e. HIPAA, FERPA, GLBA, etc.) High Information which provides access to resources, physical or virtual Only those individuals designated with approved access, signed non-disclosure agreements, and a need-to-know
  • Student education records
  • Individuals’ health records and information
  • Human subjects research data that identifies individuals
  • Prospective students
  • Personally Identifiable Financial Information
  • Campus Security Systems and Details
  • Credit card numbers
  • Certain management information
  • Social Security Numbers
  • Government restricted and/or classified Information
  • Financial transactions of students and employees
  • PS-69 Records
  • Personnel Records (Although certain records contained within employee personnel files may be “public records” subject to disclosure, personnel files should be maintained as confidential data and disclosure of “public records” shall only be made after a case-by-case determination.)
Private Data LSU has a contractual obligation to protect the data Medium Smaller subsets of protected data from a school or department LSU employees and non-employees who have a business need-to-know
  • Information resources with access to confidential data
  • Research data or results that are not confidential data
  • Information covered by non-disclosure agreements
  • Materials for performance of official duties
  • Proprietary information of LSU or others contained within proposals, contracts, or license agreements
Public Data Protection of data is at the discretion of the owner or custodian Low General University information LSU affiliates and general public with a need-to-know
  • Campus maps
  • Personal directory information (e.g., contact information)
  • Departmental websites
  • Academic course descriptions
  • News
  • Information posted on University website
  • Budgets
  • Purchase Orders