CSU Confidential Personal Data Protection Requirements

Sep 15, 2026

Uploaded by Sage

This HR memorandum outlines updated requirements for protecting confidential personal data across California State University (CSU) campuses and the Chancellor’s Office under the Information Practices Act (IPA) and Title 5. It emphasizes measures for collecting, using, maintaining, and disseminating personal information and addresses breach disclosure obligations to California residents. The memo specifies restrictions on access and transmission, training expectations, required data confidentiality agreements, faculty form requirements, and references technical security policy and attachments summarizing relevant legal provisions.

LanguageEnglish

CategoryLetters

FormatPDF

Pages5

Reading Time2 min

AccessFree to download

Requirements for Protecting Confidential Personal Data - Updated Compliance

Legal basis and breach disclosure obligations

Required administrative and access controls

Transmission limits and employee confidentiality agreements

Faculty confidentiality form requirements

Technical security measures and references

Date: April 8, 2005 Code: HR 2005-16 Reference: HR 2005-01 To: CSU Presidents Supersedes: HR 2004-08 From: Jackie R. McClain Vice Chancellor Human Resources Subject: Requirements for Protecting Confidential Personal Data: Updated to Include Information Practices Act Web Site and Security Breach Disclosure Requirements The California State University (CSU) has responsibility to protect sensitive personal data and maintain confidentiality of that data under the Information Practices Act (IPA) and Title 5. In light of rapidly changing technology and increased Internet use, this memorandum is written to highlight the importance of the CSU’s responsibility. The Information Practices Act, California Civil Code §1798, et seq., requires the Chancellor’s Office and campuses to collect, use, maintain, and disseminate information relating to individuals in accordance with its provisions. Additionally, §42396 through §42396.5 of Title 5 of the California Code of Regulations address privacy and the principles of personnel information management. For campus reference, summaries of the IPA and §42396.2 of Title 5 are provided in Attachments A and B, respectively. Additional documents on protecting confidential data are available at Human Resources’ Policy Web site at [http://www.calstate.edu/HRAdm/policies.shtml](http://www.calstate.edu/HRAdm/policies.shtml) (under Confidentiality/Protection of Personal Data) . Each campus and the Chancellor’s Office must take necessary measures to protect confidential personal information, which includes, but is not limited to, social security number, ethnicity, gender, home address, physical description, home telephone number, medical history, and performance evaluations. The CSU is obligated under IPA to disclose any breach of system security to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. General Counsel’s Records Access Manual located at [http://www.calstate.edu/gc/Docs/Records_Access_Manual.doc](http://www.calstate.edu/gc/Docs/Records_Access_Manual.doc) addresses the IPA disclosure requirements. Distribution: Executive Vice Chancellors General Counsel Vice Presidents, Administration Vice Presidents, Academic Affairs Vice Presidents, Student Affairs Vice Presidents, Information Technology Asst. Vice Chancellor, Information Technology Information Technology Advisory Committee Associate Vice Presidents/Deans of Faculty Affairs Human Resources Directors Benefits Officers Payroll Managers CMS Executive Director To protect confidential personal data, each campus and the Chancellor’s Office must follow the measures outlined below: 1. Each campus and the Chancellor’s Office must ensure that all employees with access to confidential personal information have a legitimate CSU need to have such access. These employees must understand the responsibility they have under the Information Practices Act and Title 5 to protect sensitive personal data. Training is to be provided, as required. 2. Confidential personal information should not be transmitted outside the CSU unless it is for legitimate CSU purposes. Recipients must be informed that the information provided is confidential and is provided for the sole purpose of the specific business need. Also, recipients must be informed that they are responsible for the protection of the information and the destruction of all files after the intended use is satisfied. The CSU requirements for protecting confidential personal data include the requirement that employees with access to confidential personal data in the CMS baseline system or any other computerized information system sign a data confidentiality agreement acknowledging that the employee understands requirements for protecting confidential personal data. A sample form for non-faculty employees is included for reference in Attachment C. Campuses may use an existing campu

FAQs

Which laws and regulations govern the protection of confidential personal data in this memo?

The memo cites the Information Practices Act (IPA) under California Civil Code §1798 et seq. and privacy/personnel information provisions in Title 5 of the California Code of Regulations, §§42396 through 42396.5.

What access and training requirements apply to employees handling confidential personal information?

Each campus and the Chancellor’s Office must ensure employees with access have a legitimate CSU need and understand their responsibilities under the IPA and Title 5, with training provided as required.

When must confidentiality forms be signed, and what special rules apply to faculty?

Employees with access in the CMS baseline system or other computerized systems must sign a data confidentiality agreement. A specific faculty confidentiality form in Attachment D must be used without modifying the faculty employee portion, and campuses may reuse a previously signed similar agreement.

Sep 15, 2026

Uploaded by Sage