Skip to content

Data Classifications

Last updated: February 21, 2025
Audience: All UW

Overview

UW’s Data classification scheme and process are intended to help units clarify and prioritize minimum privacy and information security protections throughout the data lifecycle, from creation or collection to propagation, disclosure, or destruction.

Administrative Policy Statement (APS) 2.4 describes three data classes: Confidential Information, Restricted Information, and Public Information. In 2017, a fourth class—Special Categories of Personal Data—was added and should be used where applicable.

Ongoing Policy and Classification Updates

The University is revising APS 2.2, 2.4, and 2.6 to improve clarity and ensure our policies effectively support the responsible management and protection of institutional data. As part of these revisions, the classification scheme is undergoing revision and will become a new Data Classification Standard. The revised classification scheme aligns with WaTech’s Data Classification Standard SEC-08-01-S and received endorsement from the UW-IT Security and Privacy Board on May 9, 2024. As part of the classification scheme revision process, we undertook a 60-day request for comment period. The most current draft includes summaries of the comments received and responses.

Data classifications

(Last updated December 16, 2022)

Confidential

University information that is protected by laws or regulations.

Special Categories of Personal Data

Categories of personal data that when alone or combined with other data could adversely impact the University or individuals. Special categories of personal data also may be confidential information in that they are protected by a law or regulation.

Special categories of personal data include but are not limited to data or information regarding:

  • Criminal offenses.
  • Citizenship and/or immigration status.
  • Race or ethnic origin.
  • Political opinions.
  • Religious or philosophical beliefs.
  • Trade union membership.
  • Genetic or biometric data used to identify a natural person.
  • Health.
  • Disability.
  • Protected veteran status.
  • Sex life.
  • Gender.
  • Gender identity.
  • Data on sex, or sexual orientation.
  • Universal identification numbers.
  • Youth under the age of eighteen.

Restricted

Restricted information is University information that is circulated on a need-to-know basis. Restricted Information needs careful management to safeguard its integrity and availability, as well as appropriate access, use, and disclosure. Restricted information is generally not published or released to the public unless specifically requested.

Public

University information that is published for public use or has been approved for public use by the appropriate University authority. Public information may not be exempt from public disclosure but does need careful management to safeguard its integrity and availability.