Data Classification

PUBLIC                                                                                     

• All information that may or must be made available to the public.
• Any information with no legal restriction on its access or use.

• General access data on www.canterbury.ac.nz
• UC annual public reports including published financial statements and other public records.
• Faculty and staff directory information
• University public event announcements, press releases, newsletters.
• Qualification entry requirements, cost, contact information.
• Published research data, publicly available third-party datasets.

• Any information that is proprietary or produced for use by members of the University community who has a legitimate purpose of accessing such data.
• Any information that unauthorised release might cause material harm to individuals or the University.
• All historic and non-classified data will be treated as “In-Confidence” unless the Data Owner or Digital Security & Risk team decides otherwise.

• Meeting agendas and minutes
• Internal operating procedures and operational manuals Non-public financial statements and procurement information.
• Memoranda, emails, reports, and other internal correspondence and documents.
• Technical documents, such as system configurations.
• Preliminary research data intended for publication.
• Drafts of research papers, Laboratory instrumental data.
• Data subject to expedited ethics approval for a low-risk application.

SENSITIVE

• Any information that is protected against disclosure by law, privacy regulators, or contract.
• Any information that requires strict protection due to the potential harm or implications that could arise from its inadvertent or malicious disclosure or misuse.
• Any information that unauthorised release could lead to serious harm for individuals or the University.

• Personal identifiable information (PII), i.e. home address, passport, driver’s license, IRD number.
• Students and staff grievances or counselling records.
• Unreleased financial information.
• Course grades.
• IT systems credentials, passwords, encryption keys or PINs.
• Health information.
• Mental health diagnosis, sexual harm notes.
• Criminal or sexual history.
• PCI DSS information.
• Commercially sensitive data, including data classified as confidential information in commercial research and consulting contracts.
• Data my be the subject of a patent application for intellectual property protection.
• Data subject to export controls.
• Data subject to UC’s ethics processes.
• Data about cultural, ethnic groups, or Māori data in general (Māori Data Sovereignty).
• Interviews, and/or video recordings involving children.

• Any information that has documented specific data handling standards, security controls, or guidelines.
• Any information that should be protected because of the national interest, security, and defence of the Government of New Zealand.

• NHI research data that has handling requirements.
• Information with NZ national security classification of Restricted, Confidential, Secret or Top Secret, e.g. research data that is Trusted Research-Protective Security Requirements.
• Māori research data may require additional handling requirements (Māori Data Sovereignty).