University of Florida Identification Number (UFID) Policy

1. Purpose

The University of Florida (“UF”) issues and maintains University of Florida Identification Numbers (“UFIDs”) as unique institutional identifiers for members of the UF community. UFIDs are sensitive identifiers subject to institutional governance and control. The UF Privacy Compliance Office (“UF Privacy”) is responsible for overseeing the safeguarding and appropriate use of UFIDs. This Policy outlines protections for UFIDs, defines their permissible uses, and supports compliance with applicable legal, regulatory and institutional requirements.

2. Applicability

This Policy applies enterprise-wide to UF including its direct support organizations (“DSOs”) and affiliated entities, as well as to UF Health and its DSOs and affiliated entities. This Policy applies to all members of the UF community, including employees and students, as well as contractors, vendors, volunteers, and third parties who create, access, process, transmit, maintain or store UFIDs in any format.

3. Definitions

Legitimate UF Business Purpose means any activity, task, or function that is necessary to perform assigned duties and supports the operations, programs, services, or administrative responsibilities of UF, including academic, research, clinical, financial, operational, compliance, or administrative functions.

UFID means an eight-digit institutional identifier (formatted as 1234-5678) assigned to individuals affiliated with UF, including faculty, staff, students, DSO personnel, and other affiliates. UFIDs are used in place of Social Security numbers for student record identification and are required for the creation and management of institutional system access credentials, including GatorLink accounts.

Restricted Data means data in any format collected, developed, maintained, or managed by or on behalf of UF, or within the scope of UF’s education, research or service missions or administrative functions, that are subject to specific protections under federal or state law, regulation or applicable contract. Student UFIDs are considered Restricted Data. However, UFIDs issued to employees do not carry this classification.

Unauthorized Access means any access, use or disclosure of UFIDs that is outside the scope of an individual’s assigned role, authorized responsibilities, or Legitimate UF Business Purpose.

4. Policy Statement

4.1. Ownership and Governance

UFIDs are UF institutional property, and UF determines the authorized use and governance of UFIDs in accordance with applicable laws and policies, including applicable UF data classification standards.

4.2. Authorized and Prohibited Uses

• UFIDs may only be used for Legitimate UF Business Purposes.
• Access to UFIDs must be limited to individuals with a Legitimate UF Business Purpose within the scope of their assigned duties or authorized role.
• UFIDs must not be used in place of more secure or legally required identifiers, such as Social Security numbers.
• UFIDs must not be used as public identifiers.

4.3. UFIDs in Email Communications

Student UFIDs are considered Restricted Data under UF data classification standards and are therefore subject to heightened protections when used in email communications. UFIDs issued to employees do not carry this classification. Questions regarding the inclusion of UFIDs in email communications should be directed to UF Privacy.

4.3.1. Permitted Use
Student UFIDs may only be included in email communications when part of an official UF record, necessary to complete an authorized business transaction, or otherwise related to a Legitimate UF Business Purpose.

4.3.2. Prohibited Practices
Student UFIDs must not be included with student names in email subject lines. Student UFIDs must not be used, in whole or in part, to post or display grades or other personal student information publicly.

4.4. Role of UF Privacy

UF Privacy is responsible for:

• Assessing authorized access to and use of UFIDs, including identifying Unauthorized Access, impermissible disclosure, or potential breaches of privacy involving UFIDs
• Collaborating with UF system owners to ensure that access to UFIDs aligns with assigned responsibilities and Legitimate UF Business Purposes
• Providing training and awareness resources regarding the appropriate handling, storage, and transmission of UFIDs
• Participating in investigations involving suspected UFID misuse, Unauthorized Access, or other privacy incidents
• Supporting UF-wide privacy compliance functions with FERPA and other applicable laws and regulations related to the collection, use, and protection of UFIDs

4.5. Security and Safeguards

UF Privacy shall collaborate as needed with UF Business Affairs, UF Information Technology, and the Office of the University Registrar to facilitate and support the implementation of appropriate administrative, technical, and physical safeguards designed to protect the privacy and security of UFIDs. Examples of such safeguards may include:

• Encryption and masking of UFIDs within electronic systems
• Role-based access controls that limit access to authorized users
• Secure transmission protocols when transmitting Restricted Data

4.6. Records Disposal Requirements

When records containing UFIDs are eligible for disposal in accordance with applicable retention requirements:

• Paper records must be shredded or secured in locked bins designated for pickup by a licensed document destruction service.
• Electronic media or systems must be sanitized or securely destroyed in accordance with applicable UF Information Security standards prior to reuse or disposal.

4.7. Policy Violations

Individuals subject to this Policy who engage in Unauthorized Access to UFIDs, or who otherwise improperly disclose or misuse UFID information, may be subject to disciplinary action up to and including termination of employment or dismissal from UF.

5. References and Related Information

• Policy 12-003: Account Management
• Policy 12-009: Control of Electronic Media
• Policy 12-011: Data Classification
• FERPA Glossary and Annual Notification
• Policy 5-007: Student Education Records and Privacy Policy (FERPA)
• UF Retention Schedules
• UF Information Security Resources
• UF Privacy Webpage
• UF Privacy Training

History