Data Classification for Cloud Services

When developing cloud based services or migrating in-house systems into the cloud it is vital that organisations understand the sensitivity and criticality of data. This is of increasing importance as the implementation of GDPR regulations comes into force and data controllers and processors need to be able to understand and document their data practices.

While the GÉANT framework agreements and cloud catalogue facilitate an easy and intuitive migration path, every institution must evaluate and assess its own data and make appropriate decisions.

To help organisations plan cloud services, the GÉANT Data Classification Tool has been created to help institutions that use cloud-based computation solutions assess data sensitivity, and criticality, to estimate the risks of placing data on the cloud. This is a critical component of General Data Protection Regulation (GDPR) compliance, and is an important indicator of whether data can, or should be, migrated to a cloud-based platform.

In accordance with the GÉANT guidelines for information classification in higher education, there are three levels of risk for data:

Low Risk	Data for public use Loss of confidentiality, integrity, or availability of the data or system has no significant impact
Medium Risk	Personally Identifiable data Data is not generally available to the public Loss of the data or system could have a mildly adverse impact
High Risk	Sensitive (Personally Identifiable) data Loss of the data or system could have a significant adverse impact on our mission, safety, finances or reputation.

The GÉANT Data Classification Tool is an easy way to assess the data a user is considering moving or placing on cloud-based solutions. Data classification uses several metrics related to security, where each metric is divided into three or four classes indicating security levels:

Confidentiality	Open Restricted Confidential
Integrity	Low Medium High
Accessibility	Low Medium High
Storage Period	Temporary Fixed Variable Permanent
Storage Location	Any EU National
Disposal Rules	Low Medium High

Download the GÉANT Data Classification Tool

Downlaod the GÉANT Data Classification Tool

Download The GÉANT Data Classification Tool Usgae Instructions

Case Study SeLCont e-learning (pdf)

Warranty and Limitation of Liability

The GÉANT Data Classification Tool is provided “as is” without warranty of any kind, either express or implied, including, but not limited to, the implied warranties of merchantability, title, non-infringement, and fitness for a particular purpose. In no event will user of the GÉANT Data Classification Tool be entitled to any damages, including lost profits or data, or other incidental or consequential damages, arising out of the use or inability to use the software or any data supplied therewith, even if the user has been advised of the possibility of such damages, or for any claim by any other party.