144  Data Security Policies UNIVERSITY OF WATERLOO Guidelines for Managing Student Information for Faculties, Academic Departments and Schools https://uwaterloo.ca/secretariat/guidelines/guidelines-managing-student-information-faculties- academic File information about multiple students separately rather than in individual student files (e.g., grade revision forms, ELPE result lists). Students may access much of their own information, but must not have access to information relating to other students. Keep particularly sensitive information such as discipline cases or medical information separately or in the file in a sealed envelope with access restricted only to those with a legitimate need to know. Make copies of student information only when absolutely necessary. Copies create extra work and extra responsibility since they are subject to the same security and destruction requirements as the official record. Securely destroy expired student information on a regular basis – once a year or once a term is usually best – following the university’s records disposal procedures