Overview
These guidelines apply to everyone who requests, approves, accesses, stores, or shares UCSB institutional data, including Data Trustees, Stewards, Custodians, and Consumers. They aim to set consistent expectations for appropriate use and to provide escalation paths when questions arise.
Institutional data: Data and information stored in UCSB’s administrative computing systems, including transactional data systems, data warehouse solutions, systems containing historical snapshots, and decision support systems. Examples include financial data, student data, employee-sponsored research information, and alumni information.
Institutional Data Sharing Guidelines
Provide access based on business needs. Provide timely and appropriate access to individuals who have a legitimate University business need to perform their assigned duties. See the Review of Data Requests section for additional requirements.
Limit access to authorized purposes. Institutional data may be accessed, used, disclosed, or shared only as necessary to perform assigned duties and for the purposes approved in the access request. Requests must clearly specify the intended use of the data, including how it will be accessed, used, stored, or shared.
Protect privacy and confidentiality. Comply with University policies, applicable laws, and requirements governing the access, use, security, and disclosure of institutional data.
Apply appropriate security controls. Protect institutional data using appropriate logical and physical security measures in accordance with University policies, applicable guidelines, and UCOP’s Electronic Information Security policy.
Follow data retention and destruction requirements. Retain and securely dispose of institutional data in accordance with applicable laws and University policies.
Maintain transparent and consistent processes. Apply data access and sharing procedures consistently, transparently, and according to established criteria.
Meet Data Custodian responsibilities. Authorized users who develop departmental systems using institutional data or store or cache institutional data assume Data Custodian responsibilities and must meet applicable security requirements. Departments needing assistance should consult their appropriate IT resource.
Comply with data use requirements. Violations may result in University disciplinary action in accordance with University policies and applicable collective bargaining agreements, as well as civil or criminal penalties where applicable.
Sensitive Data
Data Requests & Conflict Resolution
Institutional data requests often involve competing goals, such as balancing individual privacy with institutional transparency. When processing requests, the university evaluates legal, policy, and reputational factors to determine the appropriate response. Any requests involving potential conflicts are referred to the UCSB Data Privacy Committee for formal review.
Access to Sensitive
Data
Requests to access sensitive data—such as self-reported ethnicity, gender identity, sexual orientation, or immigration status—are granted or denied in accordance with FERPA and other applicable policies. Access is restricted exclusively to campus officials who demonstrate a legitimate educational interest. (Note: These sensitive data types are representative examples and not an exhaustive list.)
Financial Aid Data (HEA Regulations)
Under Higher Education Act (HEA) regulations, data derived from the FAFSA and other student financial aid records may only be used to administer financial aid programs (e.g., department scholarships). This data cannot be used for any other purpose unless it is fully aggregated.
Reporting Aggregate Data and Small Cell Sizes
When reporting sensitive data in aggregate form, cell sizes (group counts) must be 10 or greater to prevent personal identification and protect individual privacy.
- Standard Reporting Rule: Groups with fewer than 10 individuals must be reported as less than 10.
- Privacy Review: Reports containing cell sizes under 10 require careful review before public release to ensure individuals are not traceable. Data Consumers and Data Stewards should consult the Data Owner.
- Flexible Thresholds: Depending on the data type and business need, special circumstances may warrant a different small cell threshold, as determined by the Data Trustee, Data Steward, or UCSB Data Privacy Committee
Data Authorization and Training Requirements
The authorization process and the types of data that may be provided depend on the academic or administrative responsibilities of the requesting department. Some data are subject to additional requirements or restrictions. See the Sensitive Data section above for information about data that have special conditions for access or release.
Student Data
Data Consumers who access student records, regardless of where or how the data are stored or accessed, must understand and comply with the Family Educational Rights and Privacy Act (FERPA). UCSB FERPA training is available through the UC Learning Center.
Administrative Access Restrictions
Access to data may be temporarily restricted or limited due to ongoing audits or active litigation. These limitations are dictated by legal requirements and fall outside the control or authority of the Data Owner or Data Steward.
Public Requests
Any requests from the public for institutional data must be treated as public requests under the California Public Records Act (see: Public Records).
Employee Data
Data Consumers who access employee records, regardless of where or how the data are stored or accessed, must understand and comply with applicable federal and state laws and UC and UCSB policies governing the collection, use, and reporting of employee information.
When sharing employee data, commonly applicable requirements may include the Information Practices Act, Americans with Disabilities Act. and Confidentiality of Medical Information Act.
Review of Data Access Requests
Data requests will be reviewed by the appropriate data owner/data steward based on the following criteria:
Academic and Administrative Units
Data may be provided to campus officials who demonstrate a legitimate business purpose.
Third-Party Data Access & Compliance
When a UCSB unit hires or collaborates with a third-party entity (vendor or organization) to provide services that involve student or employee records:
- Required Authorization: Before hosting or collecting employee data, student records, health information, credit card information, or trade secrets/research data, both the UCSB department and the third-party entity must obtain formal approval from the Office of the Registrar for student data, Human Resources for employee data, or other relevant departments for non-student or employee data.
- Mandatory Security Appendix: Appendix DS (Data Security) is a mandatory legal document required by the University of California for any contract or purchase where a third-party vendor collects, accesses, or handles UC institutional information or IT resources. It ensures that external suppliers adhere to UC-wide cybersecurity and privacy compliance standards. Appendix DS is negotiated between Procurement and the vendor.
Research Data Access & Requests
The release of student or employee data for research is an independent institutional prerogative. Institutional Review Board (IRB) approval, exemption, or non-human subjects determination is required, but IRB approval does not guarantee access—final approval rests with Institutional Research, Planning, and Assessment (IRPA), the Office of the Registrar, Human Resources (HR) and Academic Personnel.
Submission Requirements
To submit a data request for scholarly or campus research, researchers must provide:
- Proof of IRB approval, exemption determination, or non-human subjects determination.
- A copy of the approved study protocol.
- Target sample sizes with research-design justifications (especially for survey requests).
Note: Census sampling (surveying an entire population) is generally not approved due to campus impact.
Employee Data Access
Due to strict UC data classification and privacy standards, authorization to access individual-level employee data is rarely granted.
- Aggregate Data: May be provided depending on the nature of the request.
- Individual-Specific Data: Requires formal review and approval by HR, Academic Personnel, or Equal Opportunity & Discrimination Prevention.
Recommended Best Practice
Researchers should consult the designated Data Trustee/Owner or Data Steward early in the process while preparing their IRB submission to confirm feasibility and requirements.
Student Organizations
Individuals requesting student contact data for UCSB student organizations that are registered with the Office of Student Engagement and Leadership (SEAL) will be referred to the Bulk Mailing Policy.
Mass Email
Individuals requesting student contact data in order to send mass email will be referred to the Bulk Mailing Policy and to the use of approved methods for broadcast messages and other strategies for contacting students.
Ending
Data Access
When the approved need for institutional data ends, the Data Consumer is responsible for notifying the Data Trustee/Owner and/or Data Steward. The Data Consumer must then work with the appropriate Data Trustee/Owner, Data Steward, and Data Custodian to:
- Remove access to systems and data as appropriate; and
- Securely delete or destroy copies of the data in accordance with applicable laws, regulations, and University policies.