Managing electronic data

The way we work means that we have to store, and often share, personal data via electronic means; on our work computers, laptops and mobile ‘phones.

Generally, information which is stored on the University’s servers or on an encrypted portable device is secure, but extra precautions may need to be taken where the data is of an especially sensitive or confidential nature.

Classifying data
Sharing data
Emails

Classifying data

The University classifies all of its data according to, amongst other considerations, how much personally identifiable data it contains; how sensitive that data might be for the individual or for the organisation; and the impact on either the individual or the organisation should the data be lost. The classifications apply to not just personal data but also to data which might be of financial or commercial importance to the University. Examples of how commonly used data is classified can be found in the University’s Information Management Guide and further details are available in the Information Protection Policy; an overview of the types of classification we use is below:

Unclassified:

Unauthorised disclosure of the information would result in no negative impact on individuals or the organisation.
Typically data which is anonymised or which is already in the public domain.

Classified/Confidential:

Unauthorised disclosure of the information could have a negative impact on individuals or the organisation.
Some identifiable personal data; Research grant applications/procurement arrangements.

Classified/Highly Confidential:

Unauthorised disclosure of the information would be likely to result in serious damage to the interests of individuals or of the organisation.
Special category personal data; Large volume of identifiable personal data; Commercially sensitive corporate data.

The classification of the data you are handling determines what you can do with it and what steps you must take to keep it safe. You should consult the comprehensive list of approved storage locations for different classifications of data (as explained in the Information Management Guide) and you can also refer to the University's commonly used sharing platforms.

Emails

The data which is contained in your email folders is also subject to the University’s records retention schedule. Pay particular attention to attachments which contain classified information and, as soon as practicable, store these securely and delete from your email folders.

Organising emails into folders will also make compliance with the retention schedules easier.

Separate classified from non-classified data wherever possible.