Storing

When requesting or collecting critical information from individuals or institutional sources, consider these guidelines: 

• Pause and Reflect: Consider why you need this information, whether it is required for this situation, and if your business purpose be fulfilled without it. If IU maintains the same information elsewhere, access and view the information from the existing source instead of creating another copy.
• Use it or Lose It: Keep information, in any form, only as long as it is required for business needs. If unnecessary, securely dispose of the information. If you receive information from another source, also ask the source to avoid sharing unnecessary information with you in the future. 
• Less is More: If possible, make the information less sensitive while still fulfilling your business needs. For example:
  • Collect only the last four digits of SSNs instead of the complete number. 
  • Use university ID numbers instead of more sensitive numbers like SSNs when possible and appropriate. 
  • Before creating reports, remove columns containing critical and other individually identifiable data.

For Electronic Records

IU's top data storage recommendation is Microsoft at IU Secure Storage. To ensure correct storage security and permissions, employees must request shared storage through theInstitutional Storage Request Form. You MUST go through this form if you are storing restricted or critical data classification. The form will guide you through those considerations and requirements. 

• IU has developed the Data Sharing and Handling Toolto provide guidance on data classification and where to properly store electronic records. 
• TheKnowledge Base also contains a list of dedicated file storage services that are suitable for storing various types of data.
• More information on encrypting stored critical information.
• How to verify that your computer's whole-disk encryption is enabled.

For Paper Records

Paper records containing critical data should be locked in file cabinets or secure storage rooms.

• If stored in shared locations (like University Archives), ensure that others cannot access your documents.
• Note: The IU Warehouse is no longer approved for storing university-internal, restricted, or critical institutional data.