# Data Handling ![stack of folders containing files with a metal padlock on top pile](/sites/g/files/omnuum12036/files/styles/hwp_1_1__360x360_scale/public/2026-06/datahandle3.jpeg?itok=PSlJyiu9) ## Why Data Handling Matters Proper data handling protects University Data from unauthorized access, disclosure, alteration, or loss. All **Community Members** who access, use, or work with University Data are responsible for handling it appropriately. The safeguards required for University Data depend on its risk classification. Use the guidance below to understand how University Data should be **stored, shared, transmitted, and disposed** of based on its classification level. ## University Data Handling Standards Use the [University Risk Classification](/classify-risk "Classify Risk") to determine how data must be handled. Level 1 data can be freely shared and requires no special protection. Level 5 data is reserved for exceptional cases. If you believe your data may be classified as a Level 5 Risk, contact your School Privacy & Security Officer for further guidance. ### Physical Records Protect Confidential Information by controlling access to physical records, and use contracted systems when converting them to digital format. *Use the* [***Physical Records Standard***](/data-handling#physicalrecords) *as a guide for handling University physical records and the* [***Collaboration Tools Matrix***](/data-handling#collabtoolsmatrix) *when converting to digital form.* ### Digital Records Protect Confidential Information by controlling access to digital records and only storing and sharing them on contracted systems. *Use the* [***Digital Records Standard***](/data-handling#digitalrecords) *as a guide for general data sharing, and the* [***Collaboration Tool Matrix***](/data-handling#collabtoolsmatrix) *when choosing a University system/service.* Open all sections Close all sections ### Physical Records Standard expand\_more SortActivityWhat to doLevel 2-3Level 4Sharing Limit access to those with a business need. Do not display Confidential data publicly. ✔️ ✔️ Physical Access Secure records in locked areas. Do not leave Confidential documents unattended. ✔️ ✔️ Faxing Use approved secure fax services. Limit print access to authorized personnel. ✔️ ✔️ Printing Use University managed print services. For off campus printing, use services that encrypt print job data and require authentication before releasing a document. ✔️ ✔️* Disposal Destroy paper records with cross-cut shredders or dispose in locked office bins. ✔️ ✔️ Logging Log access to facilities and records. Review logs regularly. ❌ ✔️ Transferring Use secure, traceable transfer methods (e.g.,courier services). Confirm and retain receipt. ❌ ✔️ Certificates Obtain a Certificate of Destruction and retain *if* required to meet contractual obligations. ✔️ ✔️ \*Crimson Print is approved for Level 4 data ### Digital Records Standard expand\_more Sort**Activity****What to do****Level 2–3****Level 4**Collection/Creation Limit data collection/creation to what is needed for work, research, law, or contract. ✔️ ✔️ Sharing Limit access to individuals/groups with a business need. Do not share publicly. ✔️ ✔️ Storage (Computer/Device) Store on University-issued/personal devices meeting Minimum Standards. ✔️ ❌ Storage (University Online System) Store on contracted online systems. Level 4: Encrypt ✔️ ✔️ Storage (USB/External) Level 2: Password-protected; Level 3: Encrypted/password-protected drives. ✔️ ✔️ Data in Transit/Sharing Share using contracted systems. Minimize sharing. Level 3: Encrypt. ✔️ ✔️ Deletion Use “Delete” and empty trash. Level 4: Encrypt. ✔️ ✔️ Destruction: Devices/Drives Level 2: Reuse/recycle; Level 3: Factory reset or destroy; Level 4: Secure destruction only. ✔️ ✔️* Vendors/3rd Parties Contract required. Level 3: Must include Univ. privacy/security language. Level 4: Risk assessment and approved contract. ✔️ ✔️ \*For destruction of devices/drives at Level 4, reuse and recycling are not permitted; secure destruction is required. ### Collaboration Tools Matrix expand\_more To protect University data and simplify compliance with policies, use University-supported tools and services whenever possible. The table below lists common tools for sharing data and indicates which data sensitivity levels they are approved for. Additional services may be available from your IT department. Sort**Tool** **Level 1** **Level 2** **Level 3** **Level 4** Consumer email (Gmail, Yahoo, etc) ✔️ * ❌ ❌ Consumer Google Drive - All tools ✔️ * ❌ ❌ Consumer Dropbox, Evernote ✔️ * ❌ ❌ Consumer [Encrypted External Drive](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=6e4e0334dbef6b0017d359b2ca9619d4) ✔️ ✔️ ✔️ ✔️ Harvard email (M365, Gmail) ✔️ ✔️ ❌ ❌ Harvard [Confluence/Wiki](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=00098ac2db11b410441560fdd39619ab) ✔️ ✔️1 ✔️1 ❌ Harvard GitHub [code.harvard.edu](https://code.harvard.edu/) ✔️ ✔️1 ✔️1 ❌ Harvard [Dropbox](https://huit.harvard.edu/dropbox) ✔️ ✔️1 ✔️1 ❌ Harvard Google [Drive/Docs](https://huit.harvard.edu/gmail) (g.harvard) ✔️ ✔️1 ✔️1 ❌ Harvard [Slack](https://huit.harvard.edu/slack) ✔️ ✔️ ✔️ ❌ Harvard M365 ([OneDrive](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=d247b020dbd93450441560fdd396194a), [SharePoint](https://huit.harvard.edu/sharepoint), [Teams](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=dffc57addb4b5410babda8dad3961971)) ✔️ ✔️ ✔️ ❌ Harvard M365 email with [message encryption](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=cea973b3dbf8e0d0441560fdd39619d8) ✔️ ✔️ ✔️ ✔️ Harvard [KiteWorks](https://huit.harvard.edu/kiteworks) ✔️ ✔️ ✔️ ✔️ Harvard [CrimsonPrint](https://huit.harvard.edu/crimson-print) ✔️ ✔️ ✔️ ✔️ Harvard M365 [SharePoint](https://harvard.service-now.com/ithelp?id=kb_article&sys_id=eefc7973dbb76c10babda8dad39619db) with [L4 configuration ](https://harvard.service-now.com/ithelp?id=sc_cat_item&sys_id=6de6b5856ffcb100a54fa981be3ee4a8) ✔️ ✔️ ✔️ ✔️2 Harvard [Qualtrics](https://huit.harvard.edu/qualtrics) with [L4 configuration](https://harvard.service-now.com/ithelp?id=sc_cat_item&sys_id=a93320241bf1e8505b1d3333cc4bcb73) ✔️ ✔️ ✔️ ✔️2 Harvard [Zoom](https://huit.harvard.edu/zoom) ✔️ ✔️ ✔️ ✔️3 **Notes:** \*Consumer versions not recommended for university business. 1 No “public” repositories 2 Special configuration/request required 3 No “local” recording ## Beyond the Basics: Extra Protections and Guidance At Harvard, protecting personal and other sensitive data requires more than secure technology and careful handling. Certain types of information - such as health, financial, student, or other regulated data - may be subject to additional legal, contractual, or University requirements, or may call for alternate protections due to system limitations. We've put together [some additional guidance](https://privsec.harvard.edu/additional-guidance) to help you recognize and handle these situations correctly. For choosing the right safeguards and training, [visit the Privacy Principles page](https://privsec.harvard.edu/privacy-principles). ## Related Resources Use these resources to take the next step, find University guidance, or explore trusted external references. ### University Policies Official University policies and governance guidance. - [University Information Security Policy](/information-security-policy-archived "Information Security Policy - Archived") - [OVPR Research Data Management and Policy Compliance Resources](https://research.harvard.edu/research-policies-compliance/research-data-management/) - [General Records Schedule](https://library.harvard.edu/services-tools/general-records-schedule) (GRS) ### University Standards Security and privacy requirements for protecting University information. - [Risk Classification](/classify-risk "Classify Risk") - [Minimum Standards](/apply-standards "Apply Standards") ### Roles & Responsibilities Role-based guidance for supporting a secure University environment. - [Community Members](/community-members-responsibilities "Community Members Responsibilities") - [System or Service Custodian](/system-administrators-responsibilities "System or Service Custodian Responsibilities") - [Data Stewards](/data-stewards-best-practices "Data Stewards Best Practices")