Home
LITS

Data Classification & Handling

Understanding how information is classified helps determine how it should be stored, shared, transmitted, and protected. All Trinity faculty, staff, students, contractors, and affiliates are responsible for safeguarding institutional data.

Start Here

Ask yourself:

  • Is the information intended for public release? → Level 1
  • Is it intended for internal Trinity use only? → Level 2
  • Would disclosure cause harm to an individual or Trinity? → Level 3
  • Does it contain regulated, highly sensitive, or security-related information? → Level 4

If you are unsure, treat the information as Level 3 until a classification is determined.

Data Classification Levels

Level 1: Public

Information intentionally released to the public.

  • Published research
  • Course catalogs
  • Published faculty and staff information
  • Student directory information*
  • College-wide policies
  • Press releases
  • Published marketing materials
  • Published annual reports
  • Code contributed to Open Source
  • Released patents
  • Plans of public spaces

Level 2: Internal Use

Information intended for the Trinity community.

  • Department procedures
  • Employee web/intranet portals
  • Training materials
  • Pre-release articles
  • Draft research papers
  • Work papers
  • Patent applications
  • Grant applications
  • Internal building plans
  • Physical plant information
  • Administrative survey data

Level 3: Sensitive

Information requiring a business need to know.

  • Student educational records
  • Non-public employee information
  • HUID tied to an individual
  • Personnel records
  • Donor information
  • Budget information
  • Financial transactions
  • Confidential legal matters
  • Most Trinity source code
  • IRB records
  • Security reports
  • Sensitive survey responses

Level 4: Restricted

Highly sensitive information requiring strict controls.

  • Passwords and PINs
  • System credentials
  • Private encryption keys
  • Social Security Numbers
  • Driver’s license numbers
  • Passport numbers
  • Credit card information
  • Bank account information
  • Medical information
  • Research subject data
  • Penetration test reports
  • Vulnerability assessments
  • Security architectures

*Directory information for students with FERPA restrictions should be handled as Level 3, at minimum.

Quick Handling Guide

Activity Level 1 Level 2 Level 3 Level 4
Email ✓ ✓ Authorized Recipients Secure Transfer Required
SharePoint ✓ ✓ ✓ Approved L4 Locations Only
OneDrive ✓ ✓ ✓ Approved Locations Only
External Sharing Allowed Business Need Review Required Restricted
Personal Device Allowed Secured Device College Managed Device Not Allowed

Using AI Tools

  • Determine the data classification before using an AI service.
  • Verify that the AI platform has completed Trinity’s review process.
  • Understand how data is processed, retained, and protected.
  • Only submit information you are authorized to share.

Level 4 Restricted Data should never be entered into AI systems unless specifically approved.

Disposal & Recycling

Proper disposal of information and technology assets helps protect institutional data and reduce the risk of unauthorized disclosure.

Paper Records

Level 1 (Public)

  • May be disposed of using standard recycling.

Levels 2, 3, and 4

  • Must be shredded before disposal.
  • Use approved shredding bins or document destruction services.
  • Do not place sensitive information in standard recycling containers.

Electronic Media

  • USB drives containing sensitive or restricted information must be securely wiped before disposal.
  • CDs and DVDs should be shredded or physically destroyed.
  • Never dispose of storage media containing Trinity data in regular trash.
  • Level 4 data requires secure destruction methods.

Computers & Mobile Devices

  • Do not dispose of devices through standard recycling programs.
  • Contact LITS or local IT Support for proper disposal.
  • Institutional data must be securely removed before recycling or reuse.
  • Technology assets must follow approved disposal procedures.

Disposal Quick Reference

Item Required Action
Level 1 Paper Records Recycle
Level 2-4 Paper Records Shred Before Disposal
CDs/DVDs Destroy or Shred
USB Drives Securely Wipe or Destroy
College-Owned Devices Contact LITS or Local IT Support

Need Help?

If you are unsure how information should be classified, stored, shared, transmitted, or disposed of, contact Information Security before proceeding.

[email protected]

  • Know the Policies: Review the Data Classification Standard and related Trinity policies.
  • Seek Guidance: Contact your manager or the helpdesk when you have questions about classification.
  • Exercise Discretion: Examples are illustrative and not exhaustive. Use good judgment when handling institutional data.

Revision Date: 08/2026