Record and Record Series Designation and Classification

Maturity Level

Privacy Logo

  1. Level 0: Non-Existent

    The practice is not implemented or acknowledged.
    Records are not classified according to GRAMA or other privacy laws.

    Example Strategies

    • Identify individuals who will likely learn to classify records according to GRAMA and other applicable privacy laws or until permanent individuals are established.

  2. Level 1: Ad Hoc

    Practice may occur but is undocumented (no policies or procedures), application is reactive and not standardized.
    Records might be informally classified, but there's no standard or consistent application of "public," "private," "controlled," or "protected" designations.

    Example Strategies

    • Establish a draft classification guide for common records.

  3. Level 2: Defined

    Practice is implemented and documented, but documentation may not cover all relevant aspects, and application may be informal and inconsistent.
    Basic classification guidelines are documented, but inconsistencies or omissions may occur, especially for "personal data."

    Example Strategies

    • Proactively designate all record series and report them to Archives.

  4. Level 3: Consistently Implemented

    Practice is documented to cover all relevant aspects, application is formal and consistent.
    All record series are consistently designated and classified according to Utah Code, including clear identification of all personal data, with formal procedures for review and updates.

    Example Strategies

    • Measure accuracy of initial designations via internal appeals review.

  5. Level 4: Managed

    Practice is actively managed with metrics that are regularly reviewed to assess efficacy and facilitate improvement.
    The entity regularly audits record series classifications for accuracy and compliance, tracking discrepancies and implementing corrective actions.

    Example Strategies

    • Implement real-time classification verification for outgoing data.

  6. Level 5: Optimized

    Practice is fully embedded in the entity with recognition and understanding across the workforce through active training and awareness campaigns, and inclusion in operations and strategy.
    Automated tools assist in identifying and classifying personal data within record series, and employees receive ongoing training on the importance and implications of proper data classification.