Changes are coming to how institutional data is classified at UW–Madison. On January 1, 2027, data classification will move from our current four‑tier model to a three‑tier, risk‑based one that considers the risk posed to the organization and the individual, including impact on UW–Madison operations, finances, legal compliance, or reputation.
- Low risk: minor impact.
- Moderate risk: moderate impact.
- High risk: significant impact.
UW–Madison will retire our current data classification policy (UW-504) and begin using the Universities of Wisconsin’s policy (SYS 1031). Aligning with the Universities of Wisconsin simplifies our data classification, reduces confusion, strengthens compliance, and lowers security risk. Supporting tools, training, and resources will make the transition smooth and sustainable.
Work groups address immediate needs
It will take time to implement the new classification structure robustly. The steering committee and four work groups are focused on initial needs.
- Policy and resource development: Create an inventory of key business processes and data systems that use data classification. Work with data stewards to update domain-specific classifications. Support stakeholders and update resources, websites, and policy library.
- Schema augmentation: Lay the groundwork for more automated security controls that account for risk and other factors, such as approval processes or regulatory obligations.
- Research data: Provide researchers, who are stewards of their research data, with resources, including robust examples of data classification. This work group is currently seeking feedback on draft guidance for researchers.
- Training: Review and update existing training. Develop training for data stewards and PIs about data classification.
What do you need to do?
Right now, staying informed, providing feedback, and asking questions are the most important tasks for employees. You can:
- Visit the Data Classification Initiative webpage.
- Read articles and announcements as they are shared.
- Email to ask questions or suggest resources.
- Provide feedback on draft guidance for researchers.
- Reach out to discuss your process or system if it will be impacted by the policy change.
Initiative background
The Data Classification Initiative arose from campus feedback calling for clearer examples, better training, and tools that make data classification easier to understand and apply. Success will mean a unified three-tier model (high risk, medium risk, low risk), supported by “just-in-time” guidance and automation to help everyone understand how to use, store, and share data appropriately.
This initiative is sponsored by the Chief Information Officer and the Vice Provost for Data, Academic Planning & Institutional Research (DAPIR).
Resources
Badger Data Network slide deck
Data classification initiative web page
Current UW–Madison data classification policy (UW-504) and domain-specific guidance
UW System data classification policy (SYS 1031)
Upcoming changes to data classification at UW–Madison (June 2026 article)
New Data Classification Initiative – UW–Madison Information Technology (January 2026 article)