How will your data be used?

The data you provide will only be used to conduct work required for this evaluation as outlined in the project’s scope of work.

How will your data be protected?

Administrative data, typically those involving students, teachers, and/or staff, are classified under the University’s data management regulations as moderately or highly sensitive (depending on the nature of the data).

We ask that partners upload any sensitive data to NC State’s Sharebase environment. ShareBase is approved by NC State’s Office of Information Technology for storage of all data types, including ultra sensitive data. Access to this portal is heavily restricted and only individuals with the link are able to upload data. Uploaded data is only viewable by yourself and the evaluation team.

This data is copied (preserving the original) to a secure, restricted access Google drive that is only accessible to members of the evaluation team and requires a valid NC State University login and two-factor authentication. Only researchers from the PEER team working on the evaluation project will have access. We copy the data to Google Drive so that we can open and manage files without downloading them to local machines. University-managed Google drives are approved by NC State OIT to store highly sensitive data.

Data Security Awareness training is an annual requirement for all NC State employees that includes up-to-date tactics for counteracting and preventing current cybercriminals attacks as well as a high-level overview of the Data Management Framework.

How will your data be reported?

We only report aggregated data. Groups of less than 10 are masked or left unreported to reduce the risk of re-identification of individual participants.

How long will your data be kept?

Project data is maintained in the restricted access locations described above for 12 months following the conclusion of the evaluation contract. At that time, the data is deleted.

General NC State Data Management & Data Security Resources:

NC State’s Data Management Framework –  This is the main hub for all of the University’s data policies and regulations.

REG 08.00.03 – Data Management Regulation – This regulation specifies, among other items, the four different data classification levels. They are:

1. Ultra Sensitive Data (purple classification level) – Ultra sensitive data includes data where unauthorized disclosure or loss poses the highest risk or impact to the university or its affiliates or where specific data categories require special privileged access management. Examples include social security numbers, passwords, encryption keys and biometrics (such as fingerprints and iris scans).
2. Highly Sensitive Data (red classification level) – Highly sensitive data includes data where unauthorized disclosure or loss poses a high risk or impact to the university or its affiliates. Examples include driver’s license, mother’s maiden name, passport and immigration number.
3. Moderately Sensitive Data (yellow classification level) – Moderately sensitive data includes data where unauthorized disclosure or loss poses a moderate to low risk or impact to the university or its affiliates. Examples include date of birth, race, gender and transcripts.
4. Normal Data (green classification level) – Normal or Not Sensitive data includes data where unauthorized disclosure or loss poses a low risk or impact to the university or its affiliates. This information may be disclosed to individuals regardless of their university affiliation. Minimal security measures are needed to control the unauthorized modification, use or destruction of this data.

NC State OIT Approved Data Storage Locations – a list of all potential data storage locations based on data classification level. Note that the PEER team only stores project data in ShareBase and NC State-managed Google Drives, both of which are approved for storage of highly sensitive data.