Do I have sensitive data?

A checklist to help you determine if you have any sensitive data

Reviewed by Bil Hays 04/29/2014

For details about sensitive date, please see this What is sensitive data.  This document is designed to be a quick checklist and does not go into detail. One thing to note is that you are free to do whatever you want with your personal data, this document addresses the personal data of others that you have.

I have information about individual students

Under FERPA guidelines, any private data about students is consider sensitive.  Grades are private, as is pretty much any information about a student that is not found in the Campus Directory.

I have clinical or medical data

Under HIPAA guidelines, clinical data that can be linked to an individual person is considered sensitive.  Data from which personally identifying information has been purged is considered research data and is not considered sensitive.

I have other research data from experiments on human test subjects

Data from experiments using human test subject are covered under local IRB guidelines.  Sanitized data are not considered sensitive, but any data that might be linked to individuals are. See the research guidelines, and if you have any IRB data or will be collecting IRB data for storage on a computer system, send email to help@cs.unc.edu to let us know about it, and we’ll help you meet the guidelines.

I have financial account data

Financial or other data including information such as account numbers that could be used for fraud or theft, including identity theft, are considered sensitive.  Credit card numbers, driver license numbers, social security numbers, and bank account numbers fall into this category.  SSNs are considered particularly sensitive, and should not be used as an ID where not required.

I have personnel data

Data such as an employee’s name, age, title, salary, and date of employment are considered public records and are thus not considered sensitive.  Other information placed in any employee’s file are considered private and thus sensitive.

What next?

If you have data that falls into one of the categories above, please take measures to make sure the data is secured.  See our documents on Securing Sensitive Data and Securing Your Laptop or Workstation for more information, or contact send email to help@cs.unc.edu for assistance.