Data Classification Guide to IT Services

Use this guide to make informed decisions about where to safely store and share university data. Protecting sensitive data is a shared responsibility. You are responsible for ensuring that your use of permitted services complies with laws, regulations, and policies where applicable. Please visit the Core Security Standards webpage for more information about how to safely secure workstations and servers.  Contact or with any questions.

Data Types

Public: data that is public, or published with no restrictions.  Examples include published "white pages" directory information, maps, academic course descriptions, news releases.

University/Internal: data that is non-public or internal data.  Examples of institutional data include official university records, financial reports, unofficial student records, de-identified research data. 

Restricted: data that is confidential or restricted due to personal privacy considerations or compliance regulations and laws.  Examples include student transcripts, identifiable human subjects research data, full-face photogenic images or videos, financial aid data.

Critical: data that has the most stringent legal or regulatory requirements and requires special security controls.  Examples include data governed by HIPAA (personal health information), SSNs, credit card information (PCI), personal identifiers (passport/driver's license numbers), data governed by ITAR (export-controlled).  PLEASE NOTE - PCI data should not be stored on any of the services listed below.  If you are working with PCI data, please contact the IT Security Office.


Subsets of Critical Category

For the purposes of this article, the following subsets of Critical data are included to define more clearly which campus services allow this type of information. The Critical category is very much dependent on what the specific regulation states. If you have questions about what data in the Critical category can be stored/used on any of the below services, please contact

Critical - Export-Controlled: U.S. defense-related data where disclosure to a foreign national must be prevented.  Examples include military items, space-related technology, technical defense data (e.g. ITAR, EAR)

Critical - HIPAA: protected health information (PHI) from the University of Iowa Hospitals and Clinics.  Examples of restricted data combined with any health information.


IT Tools & Services




Restricted/Critical (personal identifiers & SSNs only)



Research Data Storage Service (RDSS)***

Large Scale Storage (LSS)***

Home Drives (Files@Iowa)

Shared Drive (Files@Iowa)

OneDrive for Business

SharePoint Online (O365)


Google Drive

Apple iCloud


Personal Devices (e.g. laptops, USBs, personal cloud services, etc.)

AWS Cloud Enterprise

Microsoft Azure Cloud Services Enterprise

HPC Systems



Research Remote Desktop Service


Skype for Business


Permitted with IT Security Consultation

Not Permitted

*** HIPAA data should only be stored on a CIFS share


Article number: 
Last updated: 
May 20, 2019