Data Handling
Why Data Handling Matters
Proper data handling protects University Data from unauthorized access, disclosure, alteration, or loss.
All Community Members who access, use, or work with University Data are responsible for handling it appropriately. The safeguards required for University Data depend on its Risk Classification.
Use the guidance below to understand how University Data should be stored, shared, transmitted, and disposed.
University Data Handling Guidance
Use the University Risk Classification to determine how data must be handled.
Level 1 data can be freely shared and requires no special protection.
Level 5 data is reserved for exceptional cases. If you believe your data may be classified as a Level 5 Risk, contact your School Privacy & Security Officer for further guidance.
Physical Records
Protect Confidential Information by controlling access to physical records, and use contracted systems when converting them to digital format.
Use the Physical Records Guide for handling University physical records and the Collaboration Tools Matrix when converting to a digital form.
Digital Records
Protect Confidential Information by controlling access to digital records and storing and sharing them on contracted systems.
Use the Digital Records Guide for general data sharing, and the Collaboration Tool Matrix when choosing a University system/service.
| Activity | What to do | Level 2-3 | Level 4 |
|---|---|---|---|
Sharing | Limit access to those with a business need. Do not display Confidential data publicly. | ✔️ | ✔️ |
Physical Access | Secure records in locked areas. Do not leave Confidential documents unattended. | ✔️ | ✔️ |
Faxing | Use approved secure fax services. Limit print access to authorized personnel. | ✔️ | ✔️ |
Printing | Use University managed print services. For off campus printing, use services that encrypt print job data and require authentication before releasing a document. | ✔️ | ✔️* |
Disposal | Destroy paper records with cross-cut shredders or dispose in locked office bins. | ✔️ | ✔️ |
Logging | Log access to facilities and records. Review logs regularly. | ❌ | ✔️ |
Transferring | Use secure, traceable transfer methods (e.g.,courier services). Confirm and retain receipt. | ❌ | ✔️ |
Certificates | Obtain a Certificate of Destruction and retain if required to meet contractual obligations. | ✔️ | ✔️ |
*Crimson Print is approved for Level 4 data
| Activity | What to do | Level 2–3 | Level 4 |
|---|---|---|---|
Collection/Creation | Limit data collection/creation to what is needed for work, research, law, or contract. | ✔️ | ✔️ |
Sharing | Limit access to individuals/groups with a business need. Do not share publicly. | ✔️ | ✔️ |
Storage (Computer/Device) | Store on University-issued/personal devices meeting Minimum Standards. | ✔️ | ❌ |
Storage (University Online System) | Store on contracted online systems. Level 4: Encrypt | ✔️ | ✔️ |
Storage (USB/External) | Level 2: Password-protected; Level 3: Encrypted/password-protected drives. | ✔️ | ✔️ |
Data in Transit/Sharing | Share using contracted systems. Minimize sharing. Level 3: Encrypt. | ✔️ | ✔️ |
Deletion | Use “Delete” and empty trash. Level 4: Encrypt. | ✔️ | ✔️ |
Destruction: Devices/Drives | Level 2: Reuse/recycle; Level 3: Factory reset or destroy; Level 4: Secure destruction only. | ✔️ | ✔️* |
Vendors/3rd Parties | Contract required. Level 3: Must include Univ. privacy/security language. Level 4: Risk assessment and approved contract. | ✔️ | ✔️ |
*For destruction of devices/drives at Level 4, reuse and recycling are not permitted; secure destruction is required.
To protect University data and simplify compliance with policies, use University-supported tools and services whenever possible. The table below lists common tools for sharing data and indicates which data sensitivity levels they are approved for. Additional services may be available from your IT department.
| Tool | Level 1 | Level 2 | Level 3 | Level 4 |
|---|---|---|---|---|
Consumer email (Gmail, Yahoo, etc) | ✔️ | * | ❌ | ❌ |
Consumer Google Drive - All tools | ✔️ | * | ❌ | ❌ |
Consumer Dropbox, Evernote | ✔️ | * | ❌ | ❌ |
Consumer Encrypted External Drive | ✔️ | ✔️ | ✔️ | ✔️ |
Harvard email (M365, Gmail) | ✔️ | ✔️ | ❌ | ❌ |
Harvard Confluence/Wiki | ✔️ | ✔️1 | ✔️1 | ❌ |
Harvard GitHub code.harvard.edu | ✔️ | ✔️1 | ✔️1 | ❌ |
Harvard Dropbox | ✔️ | ✔️1 | ✔️1 | ❌ |
Harvard Google Drive/Docs (g.harvard) | ✔️ | ✔️1 | ✔️1 | ❌ |
Harvard Slack | ✔️ | ✔️ | ✔️ | ❌ |
✔️ | ✔️ | ✔️ | ❌ | |
Harvard M365 email with message encryption | ✔️ | ✔️ | ✔️ | ✔️ |
Harvard KiteWorks | ✔️ | ✔️ | ✔️ | ✔️ |
Harvard CrimsonPrint | ✔️ | ✔️ | ✔️ | ✔️ |
Harvard M365 SharePoint with L4 configuration | ✔️ | ✔️ | ✔️ | ✔️2 |
Harvard Qualtrics with L4 configuration | ✔️ | ✔️ | ✔️ | ✔️2 |
Harvard Zoom | ✔️ | ✔️ | ✔️ | ✔️3 |
Notes:
*Consumer versions not recommended for university business.
1 No “public” repositories
2 Special configuration/request required
3 No “local” recording
Beyond the Basics: Privacy & Regulated Data
Protecting sensitive data takes more than following the Minimum Standards for IT security. Information such as student records, health details, and financial files demands custom steps to comply with legal and contractual rules. If you work with these data types, check the resources below to learn more.
Related Resources
Use these resources to take the next step, find University guidance, or explore trusted external references.
University Policies
Official University policies and governance guidance.
University Standards
Security and privacy requirements for protecting University information.
Roles & Responsibilities
Role-based guidance for supporting a secure University environment.