Jump to Content

Data Classification

Data Classification is the classification of information/data at University of Galway in terms of confidentiality, integrity and availability for the purposes of data protection. The correct classification of data is important to help ensure the prevention of leaks and minimizing the impact of such leaks if they do occur.

A Data Loss Prevention is a security solution that identifies and prevents the unauthorized sharing, transfer, or use of sensitive data. It works by monitoring data at rest (stored), in motion (being transferred), and in use (being processed) across various locations, including on-premises systems, cloud services, and endpoints.

By detecting and blocking risky data activities, DLP will assist the University to prevent data breaches, maintain regulatory compliance, and protect valuable digital assets and intellectual property. In order to implement DLP, the University community will need to commence Data Classification.

Screenshot of a chart re DLP no examples

The Data Protection Office, together with ISS, are planning to introduce Data Classification and Data Loss Prevention (‘DLP’) across the University. As an essential step towards Data Loss Prevention, ISS will first implement University-wide Data Classification across the Microsoft Suite of applications – Outlook(Email), Word, Excel and PowerPoint documents.

Data classification levels are described in the University Data Classification Policy (QA402):

Public	University of Galway Controlled	University of Galway Restricted	University of Galway Highly Restricted
Public Data is information that can be communicated without restrictions and is intended for general public use. This data will not cause harm to any individual, group, or to the University if made public.	With this classification protection of information is at the discretion of the data owner and there is a low risk of embarrassment or reputational harm to the University.	The University has a legal, regulatory or contractual obligation to protect the information with this classification. Disclosure or loss of availability or integrity could cause harm to the reputation of the University or may have short term financial impact on the University.	Protection of information is required by law or regulatory instrument. The information within this classification is subject to strictly limited distribution within and outside the University. Disclosure would cause exceptional or long-term damage to the reputation of the University or risk to those whose information is disclosed or may have serious or long term negative financial impact on the University.
Examples	Examples	Examples	Examples
University guidelines and policies; University strategy; course details; public web page, press releases, event details and advertisements.	Meeting minutes; unit working & draft documents	Student or employee records; grades; employee performance reviews; personal identifiable information.	PPS numbers; Physical or mental health record relating to individuals; Critical research. LENS Report.

Benefits of having data classification in place

Data Classification is an essential element of a robust data governance system, and it will significantly improve data security within the University. It will prevent confidential information being shared with inappropriate recipients and it will minimise risks of sensitive data being disclosed as a result of data protection breaches. Crucially, introducing data classification will help to facilitate the roll out of Microsoft Copilot across all Microsoft accounts where applicable.

diagram of DLP benefits

Ultimately, once fully implemented, Data Loss Prevention will assist in risk mitigation, and it will improve overall regulatory compliance, in addition to promoting compliance with University data protection policies. Finally, it will raise awareness of data governance and data protection among staff, contractors and students. Overall having DLP in place will improve the University’s reputation and it will raise its profile.

What happens next?

Data Classification and Data Loss Prevention will be introduced in three phases:

picture showing phased roll out of DLP

During Phase I (voluntary data classification) the Data Protection Office will run a webinar for all staff explaining how to classify specific types of documents. During Phase I, the Data Protection Office will also encourage staff to submit queries via a Ms Form. Based on those queries, the office will compile the webinar and an FAQ document, which will be published on our webpage.

What will data classification look like in practice?

Each staff member will be prompted to select an appropriate sensitivity label when saving a document from the Microsoft Suite of applications – Outlook (Email), Word, Excel and PowerPoint documents (please see examples below).

Data classification will be applied in the following manner:

Emails:

Example of data classification in an email