- Purpose: Is there a clear business need and a legitimate basis for using or sharing the data?
- Data Minimization: Is the data limited to the minimum amount necessary to achieve the purpose?
- Classification: Do you know the data’s classification level and its handling requirements?
- Recipient: Have you verified the recipient’s identity, authorization, and need for the data?
- Channel: Is the method used to send or store the data official and secure?
- Approval: Have you obtained the required approvals and documented the sharing process?
If the Answer Is “No” or “Not Sure”
Temporarily stop the sharing process and seek guidance from the Data Owner, Data Steward, or Data Office.
Final Message
Data is an institutional responsibility: enter it accurately, use it for a legitimate purpose, classify it before sharing, and grant access only to those who need it and only to the extent necessary.