Classification Level

Personal Data

Sensitive Personal Data

Hyper-Sensative Personal Data

Criteria

Data this is identifiable to an individual person, but is not "Sensitive Personal Data."

Data that is identifiable to an individual person and has the potential to be used to harm or embarrass the person.

Individually identifiable data that has typically has no legitimate survey research value or purpose and has a very high potential to harm or embarrass the person.

Examples

Name
Telephone Number(s)
Address(s)
Email Address(s)
Gender
Age
Education
Licensing
Income Range
All Other Personal Data, Not "Sensitive Data"
IP Address

Salary & Compensation
Sales Production
Regulatory Disciplinary Actions

Social Security Numbers
Financial Information (e.g., credit cards, account numbers)
Passwords

Administrative Access Restrictions

Access restricted to persons with a need to know for legitimate business purposes, and who have signed a confidentiality agreement.

Access restricted to persons with a need to know for legitimate business purposes, and who have signed a confidentiality agreement, and who have been specifically designated by management.

Do not collect. Immediately notify person of disclosure and destroy data information.

Physical and Electronic Labeling

"Personal Data" label in a conspicuous location on each document, digital file, email, webpage, and on subject line of messages.

"Sensitive Personal Data" label in a conspicuous location on each document,digital file, email, webpage, and on subject line of messages.

Do not collect. Immediately notify person of disclosure and destroy data information.