KB User's Guide - Sensitive and Restricted Data Policy
Basic Policy
The KnowledgeBase may be used to provide guidance, procedures, FAQs, training materials, and references that do not contain sensitive, restricted, or protected information.
If access to sensitive or restricted data is required, users should utilize approved secure systems designed for that data classification, rather than:
- storing
- uploading
- displaying
- collecting
- requesting
the data through the KnowledgeBase. The KnowledgeBase may also be used to direct users to the appropriate secured repositories, applications, or processes where authorized access to sensitive information is managed.
Examples of prohibited uses include:
- Storing restricted or sensitive records
- Displaying protected information to users
- Collecting sensitive data through forms or prompts
- Uploading documents containing restricted information
Examples of acceptable uses of the KnowledgeBase include:
- Publishing general policies and procedures
- Sharing training and onboarding materials
- Providing links to approved secure systems
- Documenting workflows that reference, but do not contain, restricted data
- Maintaining non-sensitive internal documentation and FAQs
For more information on what qualifies as sensitive and/or restricted data, please see the UW System's "Information Security: Data Classification" page. Please also review the Registrar's "Directory Information" page for what information is contained in a students' education record that is considered protected, non-directory information (examples: SSN and Campus ID #s). Also, if you suspect the data may be considered sensitive or restricted, it is recommended that you operate as if it is, just to be safe.
Examples of Sensitive and Restricted Data
- Employee and student identification numbers (Campus ID #'s) *This is internal data when paired with things like Name and Email, and we advise against prompting for this information
- Social security numbers
- Drivers license numbers and state resident/personal identification numbers
- Financial account number (including credit/debit card) or any security code, access code or password that would permit access to an individuals financial account
- Protected health information (any information about the health status, provision of health care, or payment for health care) (except workman's comp)
- Passport numbers and alien registration numbers
- Military ID number
- Personal information such as date of birth and mothers maiden name
- Digitized signatures (ink signatures that have been digitized)
- Unique physical biometric data (including fingerprint, voice print, retina/iris image) that can be used to identify an individual
- Student educational records regulated under FERPA in conjunction with identifying references such as SSN's or student identification numbers (excluding directory data)
- Login/password credentials granting access to high risk data
- Images of any of the above (uploaded to the form)
Troubleshooting
- Unsure if something is considered sensitive or restricted? Reach out to the DoIT Help Desk. They can redirect you to the DoIT Cybersecurity team, who will be able to answer your questions.
- Google Forms Frequently Asked Questions: UW-Madison Google Workspace - FAQ
- Qualtrics Terms of Service: UW-Madison Qualtrics - Terms of Service