Data, Academic Planning & Institutional Research

Data Classification

Data classification helps UW–Madison to:

  • Protect information based on its level of risk and sensitivity.
  • Apply the appropriate safeguards to data.
  • Choose a tool that’s safe for the data.
  • Determine data access for employees with a business need.

Related information

All data at UW–Madison must be classified according to our university data classification policy, a three‑tier, risk‑based model.

Low risk

Data is classified as low risk when the loss of confidentiality, integrity, or availability of data could result in negligible operational, financial, legal, or reputational impact to the organization or the individual. Not all low risk data is public. Low risk data may require security and access controls.  

Examples:

  • Internal or unofficial data and reports.
  • Public directory information.
  • Data published on websites.
Color-coded risk meter ranging from low (green) to high (red), with the indicator pointing to the low-risk section and the label “Low Risk” displayed below.

Moderate risk

Data is classified as moderate risk when the loss of confidentiality, integrity, or availability of data could result in a moderate operational, financial, legal, or reputational impact to the organization or the individual.

Examples:

  • Some proprietary or sensitive research protocols.
  • Some employee information, such as home address.
  • Some student information, such as grades and GPAs.
Color-coded risk meter ranging from low (green) to high (red), with the indicator pointing to the moderate section and the label “Moderate Risk” displayed below.

High risk

Data is classified as high risk when the loss of confidentiality, integrity, or availability of data could result in a significant operational, financial, legal, or reputational impact to the organization or the individual.

Examples:

  • Social Security Numbers (SSNs).
  • Export controlled research.
  • Financial account numbers (e.g., bank routing numbers).
Color-coded risk meter ranging from low (green) to high (red), with the indicator pointing to the high-risk section and the label “High Risk” displayed below.

Applying data classification policy at UW–Madison

As of January 1, 2027, UW—Madison will follow SYS 1031 Data Classification. However, when classifying data, UW–Madison considers the risk to the individual in addition to the organization.  

UW–Madison faculty, staff, and students should follow UW–Madison-specific examples (link). Our examples may differ from the Universities of Wisconsin because of how our institutions experience risk. A number of factors such as compliance, research data, and student data influence how risk is experienced. 

This policy change is the result of a multi-year effort to provide clearer examples, better training, and tools that make data classification easier to understand and apply. To learn more visit Data Classification Initiative.

This is an accordion element with a series of buttons that open and close related content panels.

Former policy: UW-504 Data Classification (retired as of December 31, 2026)

On December 31, 2026 UW—Madison will retire UW-504 Policy (“Data Classification”). Descriptions of the UW-Madison’s four data classification categories under this policy are:

  • Public: data should be classified as public prior to display on web-sites or once published without access restrictions; and when the unauthorized disclosure, alteration or destruction of that data would result in little or no risk to individuals nor the University and its affiliates.
  • Internal: data should be classified as internal when the unauthorized disclosure, alteration, loss or destruction of that data could result in some risk to an individual or the University, its affiliates and research projects. By default, all Institutional Data that is not explicitly classified as Restricted, Sensitive or Public data should be treated as Internal data.
  • Sensitive: data should be classified as sensitive when the unauthorized disclosure, alteration, loss or destruction of that data could cause a moderate level of risk to an individual or the University, its affiliates and research projects. Data should be classified as Sensitive if the loss of confidentiality, integrity or availability of the data could have a serious adverse effect on university operations, assets or individuals.
  • Restricted: data should be classified as Restricted when the unauthorized disclosure, alteration, loss or destruction of that data could cause a significant level of risk to an individual or the University, its affiliates and research projects. Data should be classified as Restricted if protection of the data is required by law or regulation or UW-Madison is required to self-report to the government and/or provide notice to the individual if the data is inappropriately accessed.

Mapping between policies

Adoption of the new classification stated in SYS-1031 (low, medium, and high) will not be a one-to-one mapping. Some data from the previous classification system in UW-504 (public, internal, senstitive, and restricted) may map into one or more risk categories.

Sankee diagram showing old institutional data classification (public, internal, sensitive, restricted) to new classification (low, moderate, high).

Data classification examples by domain

As we approach the January 1, 2027 adoption date, work continues to review data classified in each domain. Some domains have completed this work and others are still in progress.

Student

Administrative and IT

Research

Data stewards are responsible for classifying the data in their domain.  Data classification examples are intended as guidance only. They are illustrative and do not constitute university policy. Classification decisions should be based on the specific data and its associated risks.

If you have questions, reach out to the appropriate data steward.