What kinds of data may I store on Box?

YES

NEEDS APPROVAL

NO

Research data subject to export controls

• Verbal communication
• Transfer of written documents
• Transfer of U.S. computer software to a foreign national whether in the U.S. or abroad if the technology is controlled by export regulations

Human subjects research data containing personally identifiable information (PII)

• A user name or email address, in combination with a password or security question and answer
• First name or first initial in combination with any one or more of the following:
  
  • SSN (SSN is not approved to be stored in BOX)
  • drivers license or state ID number
  • Account number, credit or debit card number, in combination with security code, access code, or password
  • Unique electronic ID number or routing code, in combination with security code, access code, or password
  • Unique biometric data, such as fingerprint, voice print, or retina or iris image, or other unique physical representation

Social Security Numbers

(see more information about SSN Usage Policy at https://its.unl.edu/ssn/)

Data classified as Low Risk

Low Risk data consists of institutional data used in conducting business not covered by international, state or federal privacy and security laws. Low Risk data is categorized as neither 'restricted' nor 'sensitive.' Generally, this is information that can be made available to the public without risk of harm to the university or any entities with an affiliation to the university.

Data classified as Medium Risk require high levels of protection, and it does not contain any of the non-allowed items in this chart.

Medium Risk data consists of data that is not protected by regulatory requirements, but should be protected from public view. This data might include (but is not limited to) academic, research, athletic, public service or administrative data that is restricted for reasons related to public or individual safety, competition, ongoing development or is otherwise sensitive in nature.

Data classified as High Risk (restricted use)

High Risk data is considered highly confidential and is strictly protected by federal, state, university, professional code or other binding regulation. Any data that could, by itself or in combination with other such data, be used for identity theft, fraud or other such crimes should be treated as confidential data.

- Request Approval