• Section 1 - Purpose 
• Section 2 - Application and Scope
• Section 3 - Data Classifications
• Section 4 - Data Labelling Principles
• Section 5 - Data Handling Principles
• Section 6 - Roles and responsibilities
• Section 7 - Definitions
• Section 8 - Appendices

Section 1 - Purpose 

(1) This Procedure:

1. defines and establishes data classifications to assess the sensitivity of University data; and
2. outline best practice for handling of University data in accordance with its classification to reduce data related risks.

(2) This Procedure supports and should be read in conjunction with the Data Governance and Management Policy.

Section 2 - Application and Scope

(3) This Procedure applies to:

1. University staff and affiliates; and
2. University data.

(4)  This Procedure does not apply to Research data defined in the Research Data Management Policy, with the exception of Section 3 - Data Classifications and Section 4 – Data Labelling Principles.

Section 3 - Data Classifications

(5) Data classification is the activity of categorising data based on potential impact to the University or individuals in the event of a data breach. The impact to the University is measured in line with the Enterprise Risk Management Procedures.

(6) Data must be classified using the classifications detailed in Appendix A: Data Classifications, ranked from the highest to the lowest level of sensitivity:

1. Official: Sensitive - Legal;
2. Official: Sensitive - Health;
3. Official: Sensitive - Personal;
4. Official: Sensitive;
5. Official; or
6. Unofficial.

(7) The default classification for all data, unless specified otherwise, is Official.

(8) Data assets are classified based on the highest classification level of any individual element. Data asset level classifications are recorded in the Data Asset Register.

(9) University classifications are separate from classifications assigned by State and Federal Government entities.

(10) Any data with classifications applied by State and Federal Government entities must be managed in accordance with the relevant security classification guidelines. 

Section 4 - Data Labelling Principles

(11) Data labelling is the activity of tagging or annotating data with labels that indicate the classification of the data.

(12) Institutional Data should be labelled within University storage platforms and business systems where such functionality is available. For detailed labelling instructions, refer to the platform or system labelling documentation.

(13) The process of selecting the appropriate label is outlined in Appendix B: Label Selection Assessment.

(14) A label should be applied where the labelling functionality is supported when:

1. data is created (e.g., new document, email, or report); and
2. data is received from an external source (e.g., email from a prospective student; external data set).

(15) As data sensitivity can change over time, relabelling may be required.

Section 5 - Data Handling Principles

(16) Data should be handled in accordance with the requirements of its classification, as outlined in Appendix C: Data Handling Requirements Matrix.

(17) Data received from an external party must also be managed in accordance with the relevant legislation, contracts, obligations, or other restrictions imposed by the relevant jurisdiction.

(18) Unofficial data should not be stored on University storage and should be disposed of as part of a normal administrative practice, as defined in the Records Management Policy, as soon as reasonably practicable.

Section 6 - Roles and responsibilities

(19) Data users are responsible for: 

1. using data on approved platforms, including AI, in accordance with the classification and access requirements;
2. completing necessary data training in a timely manner; and
3. appropriate retention and disposal of data in accordance with the University’s Records Management Policy.

(20) The Data and Analytics Division are responsible for: 

1. providing training and assisting University staff in the implementation of this procedure; and
2. collaborating with business system and storage platform owners to implement labelling capabilities.

(21) IMTS Service Delivery are responsible for:

1. keeping access audit logs for the necessary retention period and protecting these logs from accidental or deliberate modification;
2. providing data storage and sharing platforms suitable for all data classifications;
3. ensuring that data within storage platforms and applications is stored within the approved jurisdiction;
4. providing cybersecurity training;
5. ensuring encryption of data at rest and in transit where necessary;
6. providing controls (e.g., VPN, MFA) to securely access enterprise storage and applications where necessary; and
7. documenting data classifications for University business systems.

(22) The Information Compliance Unit are responsible for:

1. providing privacy and recordkeeping advice and training; and
2. advising data users and data guardians on information compliance requirements in accordance with legislative and business requirements.

(23) Data Guardians are responsible for:

1. approving access for data users;
2. ensuring their business systems can support data handling requirements based on classification; and
3. appropriate retention and disposal of data within their business systems and organisational unit storage.

Section 7 - Definitions

Section 8 - Appendices

Appendix A Data Classifications

Appendix B Label Selection Assessment

Appendix C Data Handling Requirements Matrix