Lancaster University has four information classifications to help you identify the level of security the information needs: Ordinary, Confidential, Restricted and Personal

Personal data includes sensitive personal data, which are special categories of personal data, such as racial or ethnic origin, political opinions, religious beliefs, sexual life, physical or mental health conditions and genetic data. Sensitive personal data is often referred to as special category data.

These classifications are Lancaster University specific and may be different at other institutions. Please watch the video to learn about the information classifications at Lancaster University and how to apply them to the information that you work with. 



Examples of each classification are below:

ClassificationWhat is it?Examples
OrdinaryData with no constraints on publication
  • University Prospectus
  • Job description
ConfidentialData with internal interest, that can be shared with others within the University, if shared externally, must come with a confidentiality agreement
  • Documents prepared for publication
  • Unpublished research data
RestrictedData only to be viewed by selected recipients
  • Committee papers
  • Documents marked for the attention of a specific reader
PersonalData only available to relevant staff only, and is protected by Data Protection law. There is a special category of personal information in the GDPR, for sensitive personal data.
  • Student contact details
  • Completed PDR forms or job applications
  • Data provided by research participants


If you are unsure what classification you should use for your information, ask yourself three questions: 

Diagram to understand classification - 1. Is the audience limited in any way - if not, it's Ordinary. If there is a limited audience, ask 2) must it remain within someone's control - if no, it's confidential. If yes, as 3) does it contain personal information - if it's not got personal information, it's restricted as it's within someones control, if it's got personally identifiable information in, then it's classed as personal data.