Loyola University Chicago

- Navigation -

Loyola University Chicago

Information Technology Services

Disposal of Sensitive Data

Scope

This policy covers disposal of all Loyola Protected data and all Loyola Sensitive data, regardless of the storage medium.

Purpose

The purpose of this policy is to provide departments and users with the standards for disposing of Loyola Protected data and with options for disposing of Loyola Sensitive data.

Policy

1. Loyola Protected data paper documents

All Loyola Protected data that exists in paper document form must be disposed of by shredding. All documents should be dropped off in designated containers that will be shredded by a licensed and bonded document destruction company. If a department does not have access to designated shredding containers, the department head or their designee shall contact Purchasing to arrange for shredding services or to purchase an individual shredder that meets or exceeds the Shredder Standards set in the appendix.

2. Loyola Sensitive data paper documents

The method of disposal for Loyola Sensitive data that exists in paper document form is left up to the department that produced those documents. They can either opt either to use the shredding option that is used in the department for Loyola Protected data in paper document form, or they can choose to take no additional steps in disposing of the documents, disposing of them the same way they dispose of Loyola Public data that exists in paper document form.

3. Loyola Protected data electronic documents

All media containing Loyola Protected data in electronic document form should be sent to the ITS Information Security team for secure deletion. The ITS Information Security team will delete the Loyola Protected data from the media in accordance with current ITS Secure Deletion procedure . Any media which cannot be processed according to this standard will be destroyed by the ITS Information Security team.

4. Loyola Sensitive data electronic documents

The method of disposal for Loyola Sensitive data in electronic document form is left up to the department that produced those documents. They can either opt to use the secure deletion option that is used for Loyola Protected electronic documents, or they can choose to dispose of them through the same method used by the department to dispose of Loyola Public data in electronic document form.

5. Loyola Protected data documents taken outside of Loyola

Any paper or electronic documents containing Loyola Protected data that are taken outside of Loyola by employees, student workers, consultants or agents of Loyola University Chicago must be returned to Loyola for proper disposal as outlined above. Any paper or electronic documents containing Loyola Protected data that are taken outside of Loyola by parties who are contractually bound to handle data produced by Loyola must dispose of paper documents through a bonded and licensed document destruction company, electronic documents through a method that meets or exceeds the standards in the Loyola Secure Deletion standards, or return the documents to Loyola for proper destruction as outlined above

6. Loyola Sensitive data documents taken outside of Loyola

Any paper or electronic documents containing Loyola Sensitive data that are taken outside of Loyola by employees, student workers, consultants or agents of Loyola University Chicago should be disposed of in a manner consistent with the originating department’s method of disposing of paper documents containing Loyola Sensitive data or returned to the department for proper disposal. Any paper or electronic documents containing Loyola Sensitive data that are taken outside of Loyola by parties who are contractually bound to handle data produced by Loyola must dispose of paper documents through a bonded and licensed document destruction company, electronic documents through a method that meets or exceeds the standards in the Loyola Secure Deletion standards, or return the documents to Loyola for proper destruction as outlined above.

Questions about this policy

If you have questions about this policy, please contact the Information Security team at DataSecurity@luc.edu .

Policy Adherence

Failure to follow this policy can result in disciplinary action as provided in the Staff Handbook, Student Worker Employment Guide, and Faculty Handbook. Disciplinary action for not following this policy may include termination, as provided in the applicable handbook or employment guide.

Appendix

Shredder Standards

All shredders used to dispose of Loyola Protected data must meet the following standards:

Large amounts of paper documents Departments that will be shredding large amount of paper documents, either on a one-time basis or on an ongoing basis, should use the University's contracted shredding service instead of individual shredders located within Loyola departments.

Bonded shredding service

Loyola uses a contracted 3rd party to provide bonded shredding services. Departments wishing to employ their services should contact the Purchasing department.

ITS Information Security team contact information

For any questions regarding the ITS Secure Deletion procedure or to arrange to have devices picked up for secure deletion, contact the ITS Information Security team at DataSecurity@luc.edu.

Policies Referenced

Data Classification Policy

Secure Deletion Procedure

History

March 4, 2008: Initial Policy
October 26, 2012: Annual Review for PCI Compliance
July 12, 2013: Annual Review for PCI Compliance
Author: UISO
Version: 1.1
 
 
PDF FILE DOWNLOAD

Loyola

Information Technology Services
1032 W. Sheridan Ave. · Chicago, IL 60660 · 773.508-4ITS

InfoServices@luc.edu

Notice of Non-discriminatory Policy