• A Data Steward must assign a “Data Protection Categorization” to a Data Element.
• A Data Steward must assign a “Data Protection Categorization” to a Data Sub-Domain, which may be derived by choosing the highest risk categorization from Data Elements within the Data Sub-Domain.
• An Associate Data Trustee must assign a “Data Protection Categorization” to a Data Domain, which may be derived by choosing the highest risk categorization from its Data Sub-Domains.
• A System Owner must assign a “Data Protection Categorization” to an Information System, which may be derived by choosing the highest risk categorization from the Organizational Data within the Information System.
• A report or a data set that contains Organizational Data may indicate the “Data Protection Categorization” in order to communicate to its intended audience the type of risk the report or data set contains.

The “Data Protection Categorization” indicates the minimum level of protections required for Organizational Data and Information Systems based on Cyber Security’s Data Protection Safeguards and Protected Data Practices. When Organizational Data may fall into more than one categorization, it should be categorized in the highest applicable risk categorization. The following categorizations are available:

1. An individual must submit a request to add a new categorization, change the name and/or definition of an existing categorization, or deprecate the use of an existing categorization to the Data Governance Committee. The request must include:
   1. Name of the categorization (proposed name if new or changing)
   2. Definition of the categorization (proposed definition if new or changing)
   3. Reason the modification is requested
2. The Data Governance Committee will review the request and determine if further discussion is required with the requestor or others involved with the request.
3. If approved, the Data Governance Committee will notify the requestor and publish the change to the official list of approved “Data Protection Categorization” choices on the website. Inventories that rely upon “Data Protection Categorization” (e.g., Data Element Dictionary) will be updated.
4. If not approved, the Data Governance Committee will articulate the rejection and send it back to the requestor.

Yes. Existing data categories I through IV are replaced with Data Protection Categorizations of “Protected” or “Public”.

Please see Cyber Security’s Data Protection Safeguards and Protected Data Practices

Please see Cyber Security’s Data Protection Safeguards and Protected Data Practices

You should categorize the Organizational Data as “Protected,” as this is the default “Data Protection Categorization.”

All Organizational Data will have a Data Regulation Categorization which informs which regulations (if any) apply to the data. Please see Cyber Security’s Data Protection Safeguards and Protected Data Practices for more information.

Yes. Student information is not targeted for public use. Protected data, including FERPA directory information, may be subject to disclosure under FERPA, the Georgia Open Records Act, or other applicable laws and regulations.