AV天堂

Skip to main content

Many UVic employees work with UVic data. Everyone who works with UVic data should follow best practices for information security.

UVic data includes student records, student grades in Brightspace and information stored in UVic's enterprise applications like Banner and FAST.

Even you don't work with classified data or if you're a student, you should be aware of how you're storing your personal data. Following best practices will help you protect yourself from identity theft, fraud, ransomware and other cyber crimes.

Training

Everyone who works at UVic should take the new employee orientation and annual staff privacy training courses offered by the Privacy and Access to Information Office

This training provides background information and context about BC's privacy laws, UVic's policies, data classifications and records management.

Email

The most common type of privacy incident is when someone accidentally shares a file or sends an email with confidential information to an unintended recipient. Whenever you're handling private or confidential information, make sure you're not sharing more than you need to. 

If you see a message or document that's been shared to unintended recipients, that's a privacy incident. Report it as soon as possible so we can help contain and respond to it.

  • Always use your UVic email address for work-related communication.
  • Use your recipient's UVic email address if they have one.
    • It's sometimes possible to recall or unsend a message sent from one UVic email to another. This is not possible with external recipients. 
    • An email address provided by another Canadian public university or agency is more secure than a commercial email service like Gmail or Hotmail.
  • Confirm an external recipient's identity before sending confidential or personal information.
  • Avoid sending confidential information in the body of an email message. If you have to use email, send the information in an encrypted attachment.

  • Encrypt documents with confidential information in them. You can encrypt documents in , and  with a password. Anyone with access to Microsoft office apps and the password will be able to open then.
    • You can also use ,  (Windows) or Archive Utility (Mac) to encrypt files or folders, but people who use different software from you might have trouble accessing them.
    • Share the password separately from the document. Options include sharing it by voice, video or text chat.

Sending emails to multiple people can make it easy to accidentally share personal or confidential information. To help avoid privacy incidents:

  • If you're sending a message to multiple people, use the BCC field to avoid exposing their identities to other recipients.
  • If you send a lot of bulk email, you might want to use special software to organize recipients and avoid accidents. Contact IT support to discuss options.

Documents

Another common cause of privacy incidents is sharing documents too broadly on a cloud storage service or accidentally sharing documents with specific people who shouldn't have access. To avoid this:

  • Use approved, secure storage like your UVic OneDrive.
  • Never use unauthorized cloud storage services like Google Drive, DropBox or iCloud for confidential information.
  • Limit how much information you store on your devices. It's safer to keep documents on a shared drive, SharePoint or OneDrive. You should only download or sync the documents you need to your device's local storage. 
  • Don't store confidential data on external storage devices (like USB flash drives or external SSDs).

If you need to use external storage or an unapproved cloud storage service, contact IT support for help minimizing your risk.

Sharing files using Microsoft 365 is usually preferable to email attachments because you can delete or revoke access to a file after you share it. But you should still be careful. An unintended recipient could read, copy or print the file before you can remove their access.

We recommend only sharing files with the specific people who need access to them. You can store collaborative documents in a Team or SharePoint site, which will automatically give access to all members.

You can share files with everyone at UVic ("people in AV天堂"), including all employees and students. If you do this, be aware that Microsoft Copilot scans content in shared files and may include it in search and chat results. Don't use this option for personal information or anything you wouldn't want to become public knowledge.

Anonymous sharing ("share with anyone") is turned off in UVic's M365 environment. You can share files with people outside of UVic using their email addresses.

Working off campus

Make sure you protect data when you're working off campus. Using non-UVic networks, even your own home network, could expose information.

Your home network

  • Use an Ethernet connection instead of Wi-Fi, if you can.
  • Limit access to your home network. Don't share it with your neighbours. If your router allows you to broadcast a separate guest network, set that up for visiting friends and family to use. 
  • If your internet service provider (ISP) supports it, configure your home router to use .
  • Most ISPs will set up your network and your router's admin tools to use complex, unique passwords. If they haven't, change the generic default passwords to something unique and secure.
  • Use UVic VPN for all your UVic work, even when you're on your home network.

Travelling and using public hotspots

  • If you have access to Eduroam while you're travelling, use that instead of commercial hotspots.
  • Use UVic VPN for all your UVic work.
  • Don't do sensitive work on free public hotspots or courtesy Wi-Fi offered by hotels and businesses. Even if they claim to be secure, their security is often weak and poorly monitored.
  • If it's possible, avoid working with confidential data while you're travelling. If you can't avoid it, talk to IT support before you go. They'll help you find the safest ways to access the information that you need.

Backups

Data on Microsoft OneDrive, SharePoint, network drives and UVic's enterprise applications is backed up automatically every night.

 on Windows and Mac computers.

Information Security Policy IM7800 includes UVic's information classification levels and storage security recommendations.

Records Management Policy IM7700 includes procedures for managing administrative records and handling information access requests.

Protection of Privacy Policy GV0235 includes procedures for privacy breaches, managing surveillance systems and personal information disclosure.

The Records Management resource page has helpful guides and advice for storing, organizing and deleting UVic data.

UVic's Privacy Office has information about privacy policies, information request procedures and employee training.

Storing and disposing of Confidential Records for Staff

Get help now

Contact IT support to:

  • Get advice on securing your UVic data.
  • Discuss file storage options.
  • Back up large amounts of data.