C109: Data Classification and Protection Policy

SCOPE

This policy applies to employees. It also applies to contractors, volunteers, consultants and third parties who create, access, use, store, and transmit or dispose of college information on behalf of the College. Students are subject to this policy when they access or handle College information through employment, research, placements, clinical activities, governance or other authorized College activities. Ordinary coursework, assignments and other materials created by students are not subject to classification under this policy unless they contain College information, personal information or information governed by legal, ethical, research or contractual requirements. This policy covers College information in any physical or digital format and location, whether on premises, in the cloud or within college or third-party platforms and services.

DEFINITIONS

Data Loss Prevention (DLP): A set of policies, processes and technologies used to detect and prevent the unauthorized disclosure or loss of sensitive information.

Data Steward: The designated administrative or academic leader responsible for decisions about information within an assigned function or data domain, including classification, access, sharing, retention, disposal, data quality, and appropriate use. The role may be supported by operational delegates but remains accountable for decisions made under this policy. If no formal Data Steward is identified, the senior administrative or academic leader for the area that creates or primarily uses the data will assume the role or identify the appropriate leader.

Sensitive Data: College information classified as Confidential or Restricted under this policy. This includes information whose unauthorized access, use, disclosure, alteration, loss or destruction could harm an individual or the College, create legal, regulatory, ethical or contractual exposure, or materially disrupt operations. Information remains subject to applicable legal, regulatory, ethical and contractual requirements regardless of its classification.

Data Classification: The categorization of information according to its sensitivity, obligations and required level of protection as Public, Internal, Confidential or Restricted.

ROLES AND RESPONSIBILITIES

Employees and other users subject to this policy

• Comply with DLP requirements and data classification standards

• Use approved systems for storing and sharing sensitive data

• Report suspected data loss, inappropriate disclosure, or unauthorized access to Information Technology Services (ITS) and the Privacy Office immediately upon discovery.

Managers

• Ensure staff are trained and aware of DLP requirements

• Enforce compliance within their departments

Information Technology Services (ITS)

• Implement and maintain DLP technologies and supporting standards, monitor and respond to DLP alerts, secure endpoints and systems, and conduct applicable technology risk assessments and assurance activities.

Privacy Office

• Define data protection requirements aligned with the Freedom of Information and Protection of Privacy Act (FIPPA)

• Provide guidance on handling data according to the classification of the data

• Support incident response and breach assessment

Data Stewards

• Define and classify data within the given data domain

• Approve exceptions to the data classification standards and DLP requirements

DATA CLASSIFICATION AND HANDLING

All College information must be classified and handled as follows:

Data Stewards must review classification decisions at least annually and when material changes occur to the information, its sensitivity, source system, administrative use, legal or regulatory obligations, or the potential impact of unauthorized disclosure, alteration, loss or misuse. Classification reviews may be incorporated into broader assurance or audit activities and must be retained as evidence.

Classification identifies the sensitivity and required protection of information. It does not, by itself, grant access. Access to information at every classification level must be authorized, necessary for a legitimate College purpose and limited to those who require it to perform their responsibilities.

INFORMATION PROTECTION AND CONTROL ASSURANCE

The College will maintain a risk-based program of administrative, technical and physical safeguards. Supporting standards and procedures will define implementation details and may vary by information type, system, legal obligation and risk. Safeguards must be sufficient to prevent, detect, and respond to inappropriate access, use, disclosure, alteration, loss, or destruction, and must be reviewed as risks and capabilities change.

Required control outcomes

• Information is inventoried and classified at a level appropriate to institutional risk.

• Access is authorized, limited to need and reviewed periodically.

• Confidential and Restricted information is stored only in approved physical or digital locations, has an accountable Data Steward, and is accessible only to authorized individuals with a legitimate College need. It must be protected during storage, use, transmission and disposal.

• Systems and third parties handling sensitive information are assessed and approved according to risk.

• Control activity and material exceptions are recorded, monitored and retained as evidence.

• Suspected incidents are detected, reported, contained and reviewed.

• Users receive role-appropriate awareness and guidance.

Assurance and evidence: Accountable areas must be able to demonstrate compliance through evidence appropriate to the risk. Evidence may include assigned ownership, information inventories, classification decisions, access approvals and reviews, system or supplier assessments, training records, retention and disposal records, exception approvals, monitoring results and incident records. ITS and the Privacy Office may request evidence, assess control effectiveness and report material gaps to the accountable leader and Policy Sponsor.

Before a third party may access, process, store, or transmit Confidential or Restricted information, the proposed arrangement must undergo a security, privacy, and other risk review proportionate to the information and service. Applicable agreements must define required safeguards, permitted uses, access and subcontracting restrictions, retention and secure disposal requirements, audit or assurance rights, and obligations upon termination. Third parties must notify the College immediately upon discovering an actual or suspected breach, loss, unauthorized disclosure or security incident involving College information and must cooperate with containment, investigation, recovery and notification activities. Supporting procurement, security and privacy standards will define detailed requirements and approval processes.

ACCEPTABLE USE AND DATA SHARING

Users may share College information only when authorized, necessary for a legitimate College purpose and appropriate for the recipient. Confidential and Restricted information must be sent through approved College platforms, with access limited to the intended recipients. Recipient identity and permission must be verified before sharing. Information must not be stored or transmitted through personal accounts, consumer file-sharing, unapproved applications, unapproved artificial intelligence services, or unapproved devices.

Classification under this policy does not determine whether information is accessible or exempt from disclosure under the Freedom of Information and Protection of Privacy Act. Requests for access must be assessed through the College’s established freedom of information process under the responsibility of the Privacy Officer. Information must not be disclosed solely because it is classified as Public or Internal.

Approved College platforms currently include Microsoft 365, Ellucian Colleague, Perceptive Content, Jadu, Workday, Shared Drive, and D2L when used for their intended institutional purposes. ITS may approve additional platforms and will maintain and communicate current guidance on approved applications.

Sensitive information must not be copied to or stored on USB drives, external hard drives or other removable storage unless a documented exception has been approved by ITS and the accountable Data Steward.

Sensitive information must not be entered into, uploaded to, processed by or used to train an artificial intelligence service unless the service has been institutionally approved for that classification and appropriate privacy, security, contractual, retention and access safeguards are in place. Approval of an artificial intelligence service for one purpose or classification does not authorize other uses.

If information contains elements from more than one classification, the highest classification applies to the complete record or data set. Information must be retained in accordance with the College records retention schedule, legal hold, contract or approved organizational need, and securely disposed of when the applicable retention requirement has been met and the information is no longer required for an authorized purpose.

MONITORING AND ENFORCEMENT

ITS, with input from the Privacy Office, Legal Counsel where required and accountable Data Stewards, will report annually to the Policy Sponsor on implementation, classification reviews, material risks, exceptions, incidents, control effectiveness and remediation. Material risks and significant non-compliance must be reported sooner. Non-compliance may result in proportionate access restrictions, corrective or disciplinary action up to and including termination of employment, contract remedies, legal action or regulatory reporting.

ITS may require technical safeguards, evidence of compliance, proportionate access or service restrictions, and remediation where information or systems face unacceptable risk. ITS may act without prior notice to contain a suspected incident, prevent material harm, meet a legal or regulatory obligation, or protect College operations. Significant restrictions and unresolved non-compliance must be reported to the Policy Sponsor and escalated through the appropriate College process.

INCIDENT REPORTING AND RESPONSE

Suspected data loss, inappropriate disclosure or unauthorized access must be reported to ITS and the Privacy Office immediately upon discovery. Users must not delay reporting while investigating, attempt to conceal an incident, or delete relevant evidence. The College will contain, assess, document and respond to the incident in accordance with its privacy breach and cybersecurity incident response processes, including notification obligations where applicable.

Exceptions: Exceptions must be approved by the accountable Data Steward and ITS before the activity occurs, with specialist input where required, and must document the organizational need, affected information and systems, risk, compensating safeguards, accountable Data Steward, approval and expiry date. Escalation to the Policy Sponsor is mandatory for Restricted information, high residual risk, actual or potential regulatory exposure, or exceptions extending beyond 12 months, including renewals. Exceptions must be time-limited, centrally recorded and reviewed at expiry. Emergency action to protect life, safety or College operations must be reported as soon as practicable.

The Policy Sponsor must ensure this policy is reviewed at least annually and following significant regulatory, security, privacy, technology or institutional change, with required amendments advanced through the applicable approval process.