Data Classification Examples

FERPA protects the privacy of student education records.

Restricted Data:

• Student Social Security Numbers (SSNs)
• Driver's license or state identification numbers
• Financial account or payment card information
• Tax records
• Protected health information contained in student records
• Combinations of student identifiers that could increase the risk of identity theft

Restricted: Combinations of student identifiers combined with other sensitive identifiers:

• Student name + Social Security number
• Student name + driver's license number
• Student name + financial account or payment card information
• Student name + passport number
• Student name + medical or health information protected by HIPAA
• Student name + authentication credentials (passwords, security questions, MFA recovery codes)

Internal Use Data:

• Student grades and transcripts
• Class schedules
• Student ID numbers (when not combined with other sensitive identifiers)
• Enrollment status
• Dates of attendance
• Directory information that has not been designated for public release

Internal Use: Combinations of student identifiers not combined with other sensitive identifiers:

• Student name + date of birth
• Student name + university ID number
• Student name + email address
• Student name + major, class year, or enrollment status

Examples of PHI Restricted Data:

Restricted: Patient, People, Student Identifiers Combined with Other Sensitive Identifiers:

• Patient name + prescription information
• Patient ID + laboratory test results
• Patient name + physician notes
• Patient name + mental health counseling records
• Patient ID + radiology/imaging reports
• Patient name + surgical history
• Patient name + health insurance member ID and claim details
• Patient address + diagnosis or treatment information
• Patient name + substance use treatment records
• Patient ID + disability or clinical accommodation records
• Patient contact information + appointment notes
• Patient name + genetic testing results

Restricted: Patient Identifiers Combined with Other Sensitive Identifiers:

• Patient name + Social Security Number (SSN)
• Patient name + driver's license number
• Patient name + passport number
• Patient ID + biometric data (fingerprint, facial recognition template, retina scan)
• Patient name + bank account number
• Patient name + credit card information
• Patient name + login credentials or authentication tokens
• Patient ID + tax identification number
• Patient name + background investigation records
• Patient name + insurance policy number and claim details

PHI - Internal Use Only: These examples contain patient identifiers but do not disclose specific medical conditions, diagnoses, treatments, or other highly sensitive health information:

• Patient name + appointment confirmation
• Patient ID + clinic registration information
• Patient name + healthcare provider assignment
• Patient name + upcoming appointment date and time
• Patient email address + patient portal enrollment status
• Patient ID + wellness program participation
• Patient name + care coordination contact information
• Patient name + clinic location assignment
• Patient ID + patient satisfaction survey participation
• Patient name + non-clinical customer service communications

Internal Use Only: Student or Patient Identifiers Not Combined with Sensitive Data:

Students:

• Student name + university email address
• Student ID + enrollment status
• Student name + academic department
• Student email + course registration information
• Student name + graduation year

Patients:

• Patient name + email address
• Patient ID + clinic location
• Patient name + preferred contact method
• Patient name + patient portal username (without password)
• Patient ID + provider office assignment

Simple Classification Rule:

Restricted:

• Student/Patient identifiers + PHI
• Student/Patient identifiers + SSN
• Student/Patient identifiers + financial account information
• Student/Patient identifiers + biometric data
• Student/Patient identifiers + authentication credentials
• Student/Patient identifiers + government-issued identifiers

Internal Use Only:

• Student/Patient identifiers + routine administrative information
• Student/Patient identifiers without medical details, financial data, credentials, or government identifiers

Examples of procurement data that should generally be classified as Restricted because they contain sensitive financial, contractual, security, or personally identifiable information:

Procurement Data - Restricted:

• Vendor contract containing confidential pricing, discounts, or negotiated rates
• Procurement records containing supplier bank account numbers or ACH payment information
• Purchase orders that include credit card numbers or payment card data
• Vendor tax forms (e.g., W-9) containing Taxpayer Identification Numbers (TIN) or Employer Identification Numbers (EIN)
• Vendor onboarding documents containing Social Security Numbers (SSNs)
• Supplier background check results
• Bids or proposals received before contract award
• Sealed bid evaluation worksheets and scoring results prior to award
• Procurement documents containing trade secrets or proprietary business information
• Contracts containing confidential intellectual property or licensing terms
• Confidential non-disclosure agreements (NDAs) and supporting documentation
• Procurement records containing system architecture diagrams or security controls from vendors
• Third-party security assessments, penetration test reports, or vulnerability assessments
• Vendor responses containing sensitive cybersecurity information
• Procurement records containing export-controlled information
• Procurement documents containing patient information (PHI)
• Procurement documents containing student records protected by FERPA
• Invoices containing bank account information and payment instructions
• Procurement records containing employee personal information
• Procurement documents containing privileged legal communications

Examples of Combinations That Make Procurement Data Restricted:

• Vendor name + bank account number
• Vendor name + routing number
• Vendor name + tax identification number
• Vendor contact + Social Security Number
• Bid response + proprietary pricing model
• Contract + confidential security requirements
• Supplier name + system credentials
• Vendor assessment + identified cybersecurity vulnerabilities
• Procurement file + patient information (PHI)
• Procurement file + student SSN or financial aid information

Simple Classification Rule: Restricted Procurement Data includes any procurement information that contains:

• Banking or payment information
• Tax identifiers (SSN, TIN, EIN)
• Confidential vendor pricing or bid information
• Proprietary or trade secret information
• Security assessment or vulnerability information
• PHI, FERPA, or other regulated data
• Authentication credentials or system access information

Routine procurement information such as a vendor name, purchase order number, commodity description, or completed contract award announcement would typically be Internal Use Only unless combined with one of the sensitive elements above.

Procurement Data – Internal Use Only: The following examples would typically be classified as Internal Use Only because they contain routine procurement or business information and do not include sensitive financial account information, tax identifiers, security-sensitive information, or other regulated data.

Vendor and Supplier Information:

• Vendor name, business address, and business phone number
• Vendor contact name and work email address
• Approved vendor lists
• Supplier catalogs and product descriptions
• Vendor marketing materials and product brochures
• Vendor meeting notes that do not contain confidential information

Purchase and Contract Administration:

• Purchase order numbers
• Requisition requests
• Purchase tracking reports
• Procurement workflow approvals
• Contract expiration dates
• Contract renewal schedules
• Lists of active contracts
• Procurement project timelines
• Procurement status reports

Budget and Spending Information:

• Department purchasing budgets
• Aggregate spending reports
• Budget-to-actual expense reports
• Procurement dashboards showing spending trends
• Commodity spend analysis
• Purchasing forecasts and planning documents

Bid and Vendor Management:

• Publicly available vendor proposals after award (when not subject to confidentiality clauses)
• Vendor performance evaluations containing routine operational feedback
• Award notifications
• Procurement committee meeting agendas
• Procurement training materials
• Vendor scorecards without confidential details

University Procurement Examples:

• Department request for office furniture
• Request for software licenses
• Purchase order for laboratory supplies
• Technology equipment inventory lists
• Vendor contact list maintained by Procurement Services
• Procurement policy and procedure documents
• Approved supplier directory
• Annual procurement activity reports

Internal Use Procurement Data Combinations: Examples of information that would generally remain Internal Use Only:

• Vendor name + business contact information
• Vendor name + contract expiration date
• Purchase order number + department name
• Vendor name + product description
• Contract number + contract start/end dates
• Supplier name + categories of goods/services provided
• Procurement requestor name + purchase justification
• Vendor name + routine performance review
• Department name + procurement budget allocation
• Procurement project name + implementation timeline

Procurement Data – Restricted vs. Internal Use:

Restricted:

• Vendor name + bank account number
• Vendor name + routing number
• Vendor name + EIN/TIN
• Procurement records containing SSNs
• Confidential bid responses before award
• Security assessments or penetration test reports
• Proprietary pricing models or trade secrets
• PHI, FERPA, CUI, or export-controlled information
• Credentials, passwords, or access keys

Internal Use Only:

• Vendor contact information
• Purchase orders without sensitive data
• Budget reports
• Procurement plans and schedules
• Contract administration records
• Approved vendor lists
• Routine vendor performance reviews
• Procurement policies and procedures

Procurement Data Classification Examples

Rule of thumb: Procurement data is generally Internal Use Only unless it contains regulated data, financial account information, tax identifiers, confidential bid information, proprietary business information, or security-sensitive details, in which case it should be classified as Restricted.

Examples of Public Procurement Data:

• Open Requests for Proposal (RFPs)
• Open Requests for Quotation (RFQs)
• Public bid advertisements
• Public contract award notices
• Procurement policies and procedures published on the university website
• Supplier registration instructions
• Procurement department contact information
• Public procurement training materials
• Annual procurement reports released to the public
• Lists of awarded contracts subject to public records requirements
• Vendor fairs, outreach events, and supplier diversity program information
• Procurement forms intended for public use

Simple Rule: Procurement data is Public when it is intentionally released for public consumption, Internal Use Only when it supports routine university operations, and Restricted when it contains confidential financial, security, legal, regulated, or proprietary information.

Examples of financial data that should be classified as Restricted but are not necessarily covered by GLBA include payroll, banking, procurement, investment, donor, and employee financial information.

Financial Data - Restricted (Non-GLBA):

Payroll and Employee Financial Information:

• Employee name + salary information
• Employee ID + compensation records
• Employee name + direct deposit information
• Employee name + bank account number
• Employee name + payroll deductions
• Employee name + garnishment records
• Employee name + retirement account information
• Employee name + tax withholding elections (W-4)

Banking and Payment Information:

• Individual name + bank account number
• Individual name + routing number
• Credit card or debit card information
• Payment card transaction details
• Merchant account information
• Electronic funds transfer (EFT) details
• ACH payment instructions

Procurement and Vendor Financial Information:

• Vendor name + bank account information
• Vendor name + ACH payment details
• Vendor name + wire transfer instructions
• Vendor name + confidential pricing information
• Vendor tax forms containing EIN/TIN
• Invoices containing sensitive payment information

Research and Grant Financial Information:

• Restricted grant budget details not yet publicly released
• Sponsored research financial reports
• Project funding allocation details
• Confidential grant proposals containing budget information

Investment and Endowment Information:

• Non-public investment portfolio information
• Endowment investment strategy documents
• Investment account numbers
• Confidential financial forecasts
• Treasury management records

Donor and Advancement Data:

• Donor name + bank account information
• Donor name + credit card information
• Donor pledge payment details
• Donor financial capacity assessments
• Estate planning documentation
• Wealth screening reports

High-Risk Combinations: The following combinations should always be treated as Restricted:

• Name + bank account number
• Name + routing number
• Name + credit card number
• Name + tax information
• Name + salary information
• Name + payroll records
• Name + investment account information
• Vendor name + payment instructions
• Donor name + payment information
• Employee name + direct deposit information

Internal Use vs. Restricted:

Restricted:

• Bank account numbers
• Routing numbers
• Credit card information
• Salary and compensation records
• Tax records
• Direct deposit information
• Investment account information
• Donor financial information
• Vendor payment information

Internal Use Only:

• Department budget summaries
• Aggregate spending reports
• Published tuition rates
• Publicly approved budgets
• Procurement spending trends without sensitive details
• Financial policies and procedures
• Financial training materials
• General accounting procedures

Simple Rule: A financial record should generally be classified as Restricted when it contains:

• An individual's or organization's financial account information
• Payment card information
• Tax information
• Payroll or compensation details
• Non-public financial transactions
• Banking or payment instructions
• Confidential financial forecasts or investment information

If disclosure could result in fraud, identity theft, financial loss, regulatory exposure, or reputational harm, the data should be classified as Restricted.

GLBA governs how financial institutions collect, handle, and protect private consumer financial data.

Under GLBA (Gramm-Leach-Bliley Act), financial aid records often contain Nonpublic Personal Information (NPI) and should be classified as Restricted when linked to an identifiable student.

Student Financial Information:

• Student name + FAFSA data
• Student ID + FAFSA Student Aid Index (SAI)
• Student name + Expected Family Contribution (EFC) (historical records)
• Student name + financial aid application data
• Student ID + loan application information
• Student name + scholarship eligibility information containing financial need details
• Student name + work-study financial records
• Student name + income verification documents

Tax and Income Information:

• Student name + IRS tax transcripts
• Student name + federal tax return information
• Student name + W-2 forms
• Student name + family income information
• Student name + tax filing status
• Student name + parent or spouse income information
• Student name + tax identification numbers

Banking and Payment Information:

• Student name + bank account number
• Student name + routing number
• Student ID + direct deposit information
• Student name + loan disbursement banking information
• Student name + refund payment information
• Student name + credit card or payment card details

Financial Aid Eligibility and Award Data:

• Student name + financial aid award package
• Student ID + Pell Grant eligibility
• Student name + federal loan eligibility
• Student name + need-based aid determinations
• Student name + financial aid appeals documentation
• Student name + satisfactory academic progress appeals containing financial aid determinations

Parent and Family Financial Information:

• Student name + parent SSN
• Student name + parent tax information
• Student name + dependency status documentation
• Student name + family financial hardship documentation
• Student name + household income records

High-Risk Combinations: The following combinations should always be considered Restricted:

• Student name + Social Security Number
• Student ID + FAFSA data
• Student name + tax return information
• Student name + bank account information
• Student name + direct deposit information
• Student name + financial aid award information
• Student name + loan records
• Student name + parent financial records
• Student name + income verification documents
• Student name + federal student aid records

Classification Rule:

Restricted (GLBA):

• Student identifier + financial information
• Student identifier + FAFSA data
• Student identifier + tax records
• Student identifier + banking information
• Student identifier + loan information
• Student identifier + financial aid awards or eligibility determinations

Internal Use Only:

• General financial aid office procedures
• Public scholarship announcements
• Financial aid training materials
• Financial aid contact information
• Published tuition and aid guidance
• Aggregate financial aid statistics not tied to individuals

Rule of thumb: If a record identifies a student and contains information used to determine, administer, disburse, or manage financial aid, it should generally be classified as Restricted under GLBA safeguards.