Note: These guidelines apply specifically to administrative data (e.g., HR, finance, student information) and not research data. For information and guidance on managing research data, please visit the Research Data Management Services website.
Overview
Data classification is the process of organizing data into categories that make it easy to retrieve, manage, and protect. Data classification involves assigning a level of sensitivity to different types of data based on their content, context, and importance to the organization. This classification helps determine the appropriate handling procedures, security measures, and access controls needed to protect the data from unauthorized access and potential breaches. By classifying data, organizations can ensure that sensitive information is adequately safeguarded while still being accessible to those who need it.
Ensuring the availability, confidentiality, and integrity of McMaster data is vital to achieving the institution’s goals. Data classification is the basis upon which the institution can determine the safeguards and practices required to meet these goals.
Data classification supports the following:
- Data and Privacy Protection: Data classification helps identify and prioritize the protection of mission-critical and sensitive information. By categorizing data based on its level of sensitivity, McMaster can implement tailored security measures to prevent denials of access, data corruption, and unauthorized access, breaches, and leaks. This proactive approach mitigates risks and safeguards critical information assets fundamental to teaching, learning, and research.
- Regulatory Compliance: McMaster is governed by strict regulations that mandate the protection of specific types of data, such as personal, financial, and health information. Data classification enables the institution to implement safeguards and practices that ensure compliance with these legal requirements, thereby avoiding potential fines, legal actions, and reputational damage. Compliance with regulations like HIPAA and others is achieved through the implementation and management of safeguards where systematic data classification is foundational.
- Appropriate Access: Data classification establishes guidelines and practices for who can access different types of information, for how long, and in what manner. By restricting access to sensitive data to only those who need it, McMaster reduces the risk of incidents caused by unintentional disclosure and intentional compromises such as insider threats and data misuse. Controlled access enhances overall data security, ensuring the confidentiality, availability, and integrity of data.
- Efficiency. Setting up and applying appropriate data security measures takes time and resources. Proper classification of data will give business users confidence that reports can be shared without restrictions.
- Risk Management: Data classifications are integral to effective risk management. By categorizing data based on its sensitivity, McMaster can better anticipate and mitigate the likelihood and impact of accidents, events, and potential threats. This proactive stance enables quicker and more effective responses to data breaches and other security incidents.
The following guidelines were created to help the McMaster community understand the official Data and Information Classification Policy and to begin implementing data classifications within their own domain.
If your role at McMaster involves any of the following responsibilities,
- Creating or maintaining data at McMaster
- A report creator, dashboard developer, or system integrator who needs access to McMaster data sources
- Responding to external requests for McMaster data
- A consumer of reports based on McMaster data sources
then these guidelines may be relevant to you.
Some of the basic questions these guidelines aim to answer are:
- I am a Data Steward. How should my data be classified?
- How does Data Classification benefit me, my department, or and the institution?
- Where should I be documenting data classifications for my domain?
- Does every data element in my domain need a classification?
- How datasets differ from individual data elements when assigning classifications?
As a living document, the guidelines for data classification will evolve through an iterative process to address emerging challenges, adapt to technological advancements, and reflect on lessons learned. A proposed review cycle of once per year will ensure that the document remains current and relevant. Feedback from business stakeholders and domain stewards across the institution will be used to refine the classifications and process recommendations.
Understanding Data Classification and Proper Data Management
Effective data classification is essential for maintaining data security, compliance, and accessibility. At McMaster, data elements documented in the institutional data catalog (The Data Cookbook) are classified into four defined classification categories. Proper classification ensures that the data is managed consistently across systems and that appropriate safeguards are applied.
Classifying and Managing Datasets
When handling datasets containing multiple data elements with different sensitivity levels, it is best practice to classify and manage access based on the highest classification level within the set. This approach ensures that all data within the dataset is protected according to the most stringent security requirements.
For example, if a dataset includes both internal and confidential data elements, the entire dataset should be classified as confidential to maintain proper access controls.
Considerations
Data elements are rarely viewed in isolation. The classification of a dataset depends on its context and usage. Consider the following example:
- An aggregated student enrollment report may be classified as internal when it contains only general statistics.
- However, if the same report includes personal identifiable information (PII) like gender and data of birth, or academic records, it may inadvertently allow individual students to be identified, requiring a higher classification level.
In institutional systems like Mosaic, some confidential fields, such as social insurance numbers and dates of birth, are masked. This measure is taken to reduce risk and protect privacy for all users, except those with proper authorization.
Although recognizing such differences can add complexity, it highlights the critical role of context in data classification and management. Addressing this nuance explicitly within data classification frameworks can help organizations achieve greater clarity and consistency.