Week One | October 5

Data Classification & Appropriate Access

You can't protect what you don't know you have. Tufts sorts information into three levels — and knowing which level you're handling determines who should be able to see it, where it can live, and how long it should stick around.

Every file you touch at Tufts falls into one of three levels: Level 1 – Public, Level 2 – Confidential, and Level 3 – Restricted institutional data. The higher the level, the more damage it can do in the wrong hands — and the more carefully it needs to be handled. Take a moment to think about what you're working with right now. A class roster, a grant budget, a donor list, health information, financial aid records — most of it is Level 2 or 3, whether or not it feels that way.

Keep it off tools that aren't approved

Free web tools, personal email, personal devices, and unapproved AI chatbots should never hold or have access to Level 2 or Level 3 data. Pasting a student's information into a random AI tool to "summarize it faster" can send that data somewhere Tufts has no control over — and no way to get it back.

Watch how you share

• Never create a public or "anyone with the link" Box link for confidential data — it can travel far beyond the people you meant to share it with.
• For Level 3 data, a shared link should never reach anyone beyond the people who already have access to that folder.
• Periodically look at who has access to your sensitive folders and remove people who no longer need it — teams change, projects end, access should too.
• Don't make extra copies of sensitive data "just in case." Every new spreadsheet or database of Level 2/3 data is another place it can leak from.
• If you do need to build a new list or database of sensitive data, decide up front how long you'll keep it and how you'll securely destroy it when the project ends.