Human Resources Data Domain

Data Domain Scope

The Human Resources data domain provides leadership, policy development, guidance and functional expertise to sustain and engage a talented, diverse workforce. The institutional data managed includes but is not limited to job and hiring records, personal demographics and contact information, compensation and classification, employee relations, time and labor, and total rewards.

Data Trustee

Data Trustees are university officials with authority over institutional data, as designated by Data Governance Council. Data trustees are accountable for managing, protecting, and ensuring the integrity and usefulness of institutional data and for upholding UW-Madison policies, UW System policies, state laws, and federal laws applicable to the institutional data.

The Data Trustee for the Human Resources data domain is the Chief Human Resources Officer.

Data Stewards

Data stewards, who are assigned by and accountable to Data Trustees, help define, implement, and enforce data management policies and procedures within their specific data domain. Institutional data stewards have delegated responsibility for all aspects of how data is acquired, used, stored, and protected throughout its entire lifecycle from acquisition through disposition.

The Employee Record Data Steward is Catharine DeRubeis, HRS Director.

Data Systems

Data Stewards identify and classify systems where data from their data domain resides. Within the Human Resources domain these are:

System	Classification
Workday (formerly HRS)	High Risk / Restricted

Data Classification Rationale

Data classification policy requires that data be classified by data stewards according to its risk. Within the Human Resources data domain, the classification rationale is:

Classification	Classification Rationale	Example(s)
High Risk / Restricted	Employee data is classified as high risk when protected under federal of state law (e.g. Social Secutiry Protection Act of 2010). The loss of confidentiality, integrity, or availability of data could result in a significant operational, financial, legal, or reputational impact to the organization or the individual.	Social Security Number, Direct deposit banking information, home address/contact information, disability information, benefits information, worker’s compensation or disability claims.
Moderate Risk / Sensitive	Employee data is classified as moderate risk when when the loss of confidentiality, integrity, or availability of data could result in a moderate operational, financial, legal, or reputational impact to the organization. This includes: Sensitive Data – Data limited to defined users, roles, or groups within the organization based on specific business needs. By default, all institutional data that is not explicitly classified must be treated as Sensitive data.	Faculty and staff reviews and performance evaluations, directory information for employees who have chosen to withhold their personal information, emails and other communications regarding internal UW System matters which have not been specifically approved for public release.
Low Risk / Internal	Employee data is classified as low risk when the loss of confidentiality, integrity, or availability of data could result in negligible operational, financial, legal, or reputational impact to the organization. This includes: Internal Data – Data made available to internal users but not intended to be openly shared on public websites or in other public forums.	Information used for staff management planning, including judgments or recommendations concerning future salary adjustments or other wage treatments, management bonus plans, promotions, and job assignments are considered internal.
Public	Public Data – Data made available for public use and consumption and can be openly shared or discussed with anyone.	Directory information, aggregate data on employee population, employee salary information.