Confidential Data

Confidential data refers to business sensitive and personally identifiable information (PII) not intended for disclosure outside the organization.  

Confidential data includes:

• a person's name in conjunction with the person's Social Security, credit or debit card, individual financial account, driver's license, state ID, or passport number
• a name in conjunction with biometric information about the named individual
• human subject information
• personally identifiable medical information

The University of Dayton is required to comply with:

• Family Educational Records Protection Act (FERPA)
• Health Information Portability and Accountability Act (HIPAA)
• Payment Card Industry (PCI)

Your responsibility:

• Locate Personally Identifiable Information (PII)
• Report an IT Security Breach

Locate Personally Identifiable Information (PII)

Tools that assist in finding personally identifiable information include:

Cornell Spider - http://www.it.cornell.edu/services/spider/howto/index.cfm

IdentityFinder - http://www.identityfinder.com/us/Home/Free (personally owned machines only, free version may not be used on UD owned computers or laptops)

Report an IT Security Breach

An IT Security Incident is any adverse event which compromises some aspect of computer or network security.

Security incidents that must be reported include:

• compromise of user credentials
• lost or stolen laptop
• lost or stolen removable media (CD, DVD, USB flash drive, external hard drive, smart cards)
• malware or virus infected computer

All incidents should be taken seriously and reported according to UD's policy on IT Incident Handling.  When in doubt, report it!