[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-seo-276299-105":3,"detail-sidebar-cat-1-en-105":81,"doc-detail-276299-en":127},{"code":4,"msg":5,"data":6},0,"ok",{"site_id":7,"language":8,"slug":9,"title":10,"keywords":11,"description":12,"schema_data":13,"social_meta":74,"head_meta":76,"extra_data":78,"updated_unix":80},105,"en","csu-confidential-personal-data-protection-requirements","CSU Confidential Personal Data Protection Requirements","","This HR memorandum outlines updated requirements for protecting confidential personal data across California State University (CSU) campuses and the Chancellor’s Office under the Information Practices Act (IPA) and Title 5. It emphasizes measures for collecting, using, maintaining, and disseminating personal information and addresses breach disclosure obligations to California residents. The memo specifies restrictions on access and transmission, training expectations, required data confidentiality agreements, faculty form requirements, and references technical security policy and attachments summarizing relevant legal provisions.",{"@graph":14,"@context":73},[15,34,56],{"@type":16,"itemListElement":17},"BreadcrumbList",[18,23,27,31],{"item":19,"name":20,"@type":21,"position":22},"https://docshare.wps.com","Home","ListItem",1,{"item":24,"name":25,"@type":21,"position":26},"https://docshare.wps.com/template/","Template",2,{"item":28,"name":29,"@type":21,"position":30},"https://docshare.wps.com/template/letters/","Letters",3,{"item":32,"name":10,"@type":21,"position":33},"https://docshare.wps.com/template/csu-confidential-personal-data-protection-requirements/276299/",4,{"url":32,"name":10,"@type":35,"image":36,"author":41,"headline":10,"publisher":44,"fileFormat":47,"inLanguage":8,"description":12,"dateModified":48,"datePublished":49,"encodingFormat":47,"isAccessibleForFree":50,"interactionStatistic":51},"DigitalDocument",{"url":37,"@type":38,"width":39,"height":40},"https://docshare.wps.com/thumbnails/csu-confidential-personal-data-protection-requirements/276299.png","ImageObject",442,249,{"name":42,"@type":43},"Sage","Person",{"url":19,"name":45,"@type":46},"DocShare","Organization","application/pdf","2026-10-22","2026-09-15",true,{"@type":52,"interactionType":53,"userInteractionCount":55},"InteractionCounter",{"@type":54},"ViewAction",13,{"@type":57,"mainEntity":58},"FAQPage",[59,65,69],{"name":60,"@type":61,"acceptedAnswer":62},"Which laws and regulations govern the protection of confidential personal data in this memo?","Question",{"text":63,"@type":64},"The memo cites the Information Practices Act (IPA) under California Civil Code §1798 et seq. and privacy/personnel information provisions in Title 5 of the California Code of Regulations, §§42396 through 42396.5.","Answer",{"name":66,"@type":61,"acceptedAnswer":67},"What access and training requirements apply to employees handling confidential personal information?",{"text":68,"@type":64},"Each campus and the Chancellor’s Office must ensure employees with access have a legitimate CSU need and understand their responsibilities under the IPA and Title 5, with training provided as required.",{"name":70,"@type":61,"acceptedAnswer":71},"When must confidentiality forms be signed, and what special rules apply to faculty?",{"text":72,"@type":64},"Employees with access in the CMS baseline system or other computerized systems must sign a data confidentiality agreement. A specific faculty confidentiality form in Attachment D must be used without modifying the faculty employee portion, and campuses may reuse a previously signed similar agreement.","https://schema.org",{"og:url":32,"og:type":75,"og:title":10,"og:site_name":45,"og:description":12},"article",{"robots":77,"canonical":32},"index,follow",{"doc_id":79,"site_id":7},276299,1790044638,{"code":4,"msg":82,"data":83},"success",[84,89,94,99,104,109,114,118,123],{"id":85,"doc_module":22,"doc_module_name":25,"category_name":86,"show_sort_weight":87,"slug":88},11,"Presentations",90,"presentations",{"id":90,"doc_module":22,"doc_module_name":25,"category_name":91,"show_sort_weight":92,"slug":93},12,"Resumes",80,"resumes",{"id":95,"doc_module":22,"doc_module_name":25,"category_name":96,"show_sort_weight":97,"slug":98},14,"Invoices",70,"invoices",{"id":100,"doc_module":22,"doc_module_name":25,"category_name":101,"show_sort_weight":102,"slug":103},15,"Posters",60,"posters",{"id":105,"doc_module":22,"doc_module_name":25,"category_name":106,"show_sort_weight":107,"slug":108},16,"Social Media",50,"social-media",{"id":110,"doc_module":22,"doc_module_name":25,"category_name":111,"show_sort_weight":112,"slug":113},17,"Forms",40,"forms",{"id":115,"doc_module":22,"doc_module_name":25,"category_name":29,"show_sort_weight":116,"slug":117},18,30,"letters",{"id":119,"doc_module":22,"doc_module_name":25,"category_name":120,"show_sort_weight":121,"slug":122},21,"Paper Templates",5,"papers-templates",{"id":124,"doc_module":22,"doc_module_name":25,"category_name":125,"show_sort_weight":4,"slug":126},158,"General","general-158",{"code":4,"msg":82,"data":128},{"doc_id":79,"user_id":129,"nickname":42,"user_avatar":130,"doc_module":22,"category_id":115,"category_name":29,"doc_title":10,"doc_description":12,"doc_content":131,"file_id":132,"file_url":133,"file_type":134,"file_size":135,"view_count":55,"is_deleted":4,"is_public":22,"is_downloadable":22,"audit_status":22,"page_count":121,"language":136,"language_code":8,"site_id":7,"html_lang":8,"table_of_contents":137,"faqs":138,"seo_title":139,"seo_description":12,"update_tm":140,"read_time":26},687197207057,"https://ap-avatar.wpscdn.com/davatar_29158cc5080c5b710cf443261637dec0","Date: April 8, 2005 Code: HR 2005-16  \nReference: HR 2005-01  \nTo: CSU Presidents  \n  Supersedes: HR 2004-08  \nFrom: Jackie R. McClain   \nVice Chancellor   \nHuman Resources  \nSubject: Requirements for Protecting Confidential Personal Data: Updated to Include  \nInformation Practices Act Web Site and Security Breach Disclosure Requirements  \nThe California State University (CSU) has responsibility to protect sensitive personal data and maintain confidentiality of that data under the Information Practices Act (IPA) and Title  \n5. In light of rapidly changing technology and increased Internet use, this memorandum is written to highlight the importance of the CSU’s responsibility. The Information Practices Act, California Civil Code §1798, et seq., requires the Chancellor’s Office and campuses to collect, use, maintain, and disseminate information relating to individuals in accordance with its provisions. Additionally, §42396 through §42396.5 of Title 5 of the California Code of Regulations address privacy and the principles of personnel information management. For campus reference, summaries of the IPA and §42396.2 of Title 5 are provided in Attachments A and B, respectively. Additional documents on protecting confidential data are available at Human Resources’ Policy Web site at [http://www.calstate.edu/HRAdm/policies.shtml](http://www.calstate.edu/HRAdm/policies.shtml) (under Confidentiality/Protection of Personal Data) .  \nEach campus and the Chancellor’s Office must take necessary measures to protect confidential personal information, which includes, but is not limited to, social security number, ethnicity, gender, home address, physical description, home telephone number, medical history, and performance evaluations.  \nThe CSU is obligated under IPA to disclose any breach of system security to California residents whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. General Counsel’s Records Access Manual located at [http://www.calstate.edu/gc/Docs/Records_Access_Manual.doc](http://www.calstate.edu/gc/Docs/Records_Access_Manual.doc) addresses the IPA disclosure requirements.  \nDistribution:  \nExecutive Vice Chancellors General Counsel  \nVice Presidents, Administration Vice Presidents, Academic Affairs Vice Presidents, Student Affairs  \nVice Presidents, Information Technology  \nAsst. Vice Chancellor, Information Technology  \nInformation Technology Advisory Committee Associate Vice Presidents/Deans of Faculty Affairs Human Resources Directors  \nBenefits Officers Payroll Managers CMS Executive Director  \nTo protect confidential personal data, each campus and the Chancellor’s Office must follow the measures outlined below:  \n1. Each campus and the Chancellor’s Office must ensure that all employees with access to confidential personal information have a legitimate CSU need to have such access. These employees must understand the responsibility they have under the Information Practices Act and Title 5 to protect sensitive personal data. Training is to be provided, as required.  \n2. Confidential personal information should not be transmitted outside the CSU unless it is for legitimate CSU purposes. Recipients must be informed that the information provided is confidential and is provided for the sole purpose of the specific business need. Also, recipients must be informed that they are responsible for the protection of the information and the destruction of all files after the intended use is satisfied.  \nThe CSU requirements for protecting confidential personal data include the requirement that employees with access to confidential personal data in the CMS baseline system or any other computerized information system sign a data confidentiality agreement acknowledging that the employee understands requirements for protecting confidential personal data. A sample form for non-faculty employees is included for reference in Attachment C. Campuses may use an existing campu","cbCaiuq1mml4PunC","https://ap.wps.com/l/cbCaiuq1mml4PunC","pdf",401123,"English","# Requirements for Protecting Confidential Personal Data - Updated Compliance\n## Legal basis and breach disclosure obligations\n## Required administrative and access controls\n## Transmission limits and employee confidentiality agreements\n## Faculty confidentiality form requirements\n## Technical security measures and references","[{\"question\":\"Which laws and regulations govern the protection of confidential personal data in this memo?\",\"answer\":\"The memo cites the Information Practices Act (IPA) under California Civil Code §1798 et seq. and privacy/personnel information provisions in Title 5 of the California Code of Regulations, §§42396 through 42396.5.\"},{\"question\":\"What access and training requirements apply to employees handling confidential personal information?\",\"answer\":\"Each campus and the Chancellor’s Office must ensure employees with access have a legitimate CSU need and understand their responsibilities under the IPA and Title 5, with training provided as required.\"},{\"question\":\"When must confidentiality forms be signed, and what special rules apply to faculty?\",\"answer\":\"Employees with access in the CMS baseline system or other computerized systems must sign a data confidentiality agreement. A specific faculty confidentiality form in Attachment D must be used without modifying the faculty employee portion, and campuses may reuse a previously signed similar agreement.\"}]","CSU Confidential Personal Data Protection Requirements | PDF",1789492431]