Data Classification & Management Policy

Institutional data is a critical strategic asset of Dublin City University (DCU). It is created, collected, stored, and processed to support teaching, learning, research, and the effective operation of the University.

To protect this information, DCU must ensure that all data is handled with a level of security appropriate to its sensitivity and the risks associated with its loss, misuse, or unauthorised disclosure.

This policy establishes a unified framework for classifying all university data, whether electronic or physical. A consistent classification approach supports effective data management, enables risk based protection, ensures regulatory compliance, and safeguards the financial, legal, and reputational interests of the University and its community.
 

The purpose of this policy is to:

• Establish a Standardised Framework for classifying institutional data based on sensitivity and risk
• Enable Risk-Based Protection by defining the application of appropriate security controls.
• Define Governance Rolesand clarify responsibilities for data management and use.

• Ensure Regulatory Alignment with legal, statutory, and contractual obligations, including GDPR.

• Foster Shared Responsibility by ensuring all members of the DCU community understand the value and sensitivity of the information they handle.

This policy applies to all University data, regardless of its format or where it is stored (e.g., on-campus servers, cloud services, personal devices, physical locations).

This policy applies to all units of the University, both academic and professional support departments, including DCU research centres and wholly owned campus companies and 3rd party holders of DCU data, in accord with the contractual obligations for use of university data. It is noted that while the classification and management of data in campus companies are subject to privacy protections aligned with GDPR, campus company data is not subject to Freedom of Information requests. Throughout this policy, these entities are collectively referred to as “the University”.

All University data must be assigned one of four classification levels. The classification reflects the potential impact on the University or to individuals if the data were disclosed, altered, or destroyed without authorisation.

Level 1- Public Data:   Public Data are university data that can be made available for public consumption, including data published by the university, and data made available under governance arrangements, e.g. annual reports.  The use or disclosure of public data poses no commercial, reputational or regulatory risk to the institution.

Level 2- Internal Data: Internal data are university data that are intended for internal University use only, however, and unauthorised disclosure outside of the University would result in minor operational inconvenience or reputational embarrassment.  Generally, internal data is made available to all staff internally to support their work.

Level 3- Confidential Data:  Confidential data are restricted to individuals and teams who require access for the purposes of fulfilling their roles. This information is often central to the university’s operations on university systems and may include information of identifiable individuals, or budgetary information.  Unauthorised disclosure of confidential information could result in regulatory penalties, financial loss, or cause reputational harm to the university.

Level 4- Highly Restricted Data:  Highly restricted data are the most sensitive data held by the university, including sensitive information about both staff and students.   The sensitive nature of highly restricted data means they are held only for specific and necessary purposes and must be treated with the highest levels of protection, including specific protocols on accessing data for specific purposes. Unauthorised disclosure of highly restricted data is deemed to have the potential for significant harm to individuals, and extensive reputational or regulatory damage to the institution. 

Clear articulation of responsibilities is essential for the effective oversight of university data. The following roles are central to this policy:

Data Trustee: As per the DCU Data Governance Policy, data trustees have ultimate responsibility for the overall oversight of data domains under their executive remit. In the context of this policy, Data Trustees are responsible for,

• Ensuring the classifying data assets under their control in accordance with this policy.
  • Ensuring existence of process for the approval and regular review of access privileges.
  • Ensuring that data are managed in compliance with relevant policies and regulations.
  • Delegating the day-to-day management of data to appropriately senior colleagues, including domain-level Data Stewards.

Data Stewards/ Heads of Departments: Data stewards are identified in some university departments and have responsibility for overseeing the implementation of data governance and data quality within their university department or unit.  In other cases, this responsibility will lie with heads of department within university departments.  In this context of this policy, data stewards or heads of department are responsible for,

• Implementing the data classification procedures approved by the Data Trustee.
  • Defining and managing data quality, integrity, and business rules.
  • Overseeing access controls (including withdrawal of access) and ensuring data is used for its intended purpose.
  • Ensuring colleagues within the area are aware of their responsibilities to appropriately manage and protect university data

Data Custodian: Data Custodians are defined in the Data Governance Policy as being responsible for managing and protecting institutional data to ensure its security, accuracy, and compliance with regulatory and institutional policies. Data custodians are typically involved in overseeing technical aspects of data storage, access, integration, and processing. In the context of this policy data custodians may be responsible for, 

• Implementing and maintaining the technical security controls (e.g., encryption, firewalls, access logs) appropriate for the data's classification.
  • Ensuring the data handling and security procedures are followed.
  • Managing data backup and recovery.

Data User: Any individual (staff, student, contractor) who accesses, processes, or otherwise handles University data in the performance of their duties. 

The Data User is responsible for:

• Handling all data in accordance with its classification and the University's policies.
  • Using data only for authorised purposes.
  • Reporting any suspected or actual data breaches or security incidents immediately.

The unauthorised use of university data, including the failure to comply with this policy, constitutes a violation of this policy.  Violation of this policy may result in a revocation of access to university data. Significant and conscious disclosure of internal, confidential or highly restricted data may result in revocation of access privileges and/or disciplinary action.

This policy should be read in conjunction with the following policies / procedures / guidelines:

• DCU Data Governance Policy

• DCU Data Privacy Policy

• Personal Data Retention Policy

• DCU Compliance Policy

• Digital Access Control Policy

• Digital Identity Retention Policy

• Information & Communications Technology (ICT) Security Policy

• Personnel Files Access Policy

• Intellectual Property Policy

• Code of Good Research Practice

Any queries regarding this policy should be directed Aisling McKenna, Data Governance and Strategy Intelligence.

This policy will be reviewed every 5 years.