What is Sensitive Data?
Sensitive data is defined as information that is protected against unwarranted disclosure. Access to sensitive data should be safeguarded. Protection of sensitive data may be required for legal or ethical reasons, for issues pertaining to personal privacy, or for proprietary considerations.
Sensitive Information includes all data, in its original and duplicate form, which contains:
- Personal Information, as defined by the North Carolina Identity Theft Protection Act of 2005
- Protected Health Information, as defined by the Health Insurance Portability and Accountability Act of 1996 (HIPAA)
- Student education records, as defined by the Family Educational Rights and Privacy Act (FERPA)
- Customer record information, as defined by the Gramm Leach Bliley Act (GLBA)
- Card holder data, as defined by the Payment Card Industry (PCI) Data Security Standard
- Confidential personnel information, as defined by the State Personnel Act
- Information that is deemed to be confidential in accordance with the North Carolina Public Records Act
Sensitive data also includes any information that is protected by University policy from unauthorized access. This information must be restricted to those with a legitimate business need for access. Examples of sensitive information may include, but are not limited to, some types of research data (such as research data that is personally identifiable or proprietary), public safety information, financial donor information, information concerning select agents, system access passwords, information security records, and information file encryption keys.
If further clarification is required, please contact the Information Security Office at security@unc.edu or 445-9393 and we will facilitate any necessary clarification in collaboration with the office of University Counsel.
Document Overview
Tags: NoneSubjects: Security , Policies and Legal Issues
Audience: Everyone
This work is licensed under a Creative Commons Attribution 3.0 United States License.
