When you submit an overall project evaluation request—which encompasses data uses, vendors, and products—through the UF IT Security IRM Risk Requests and Assessments process, UF IT Security coordinates the overarching assessment. The UF Privacy Office serves as an Ancillary Reviewer.

UF IT Security assigns us to a risk assessment whenever a project, software, hardware, or third-party service involves the collection, storage, processing, or sharing of personal data or other data types https://policy.ufl.edu/policy/data-classification-policy/. Our specific role is to evaluate data privacy compliance, regulatory exposures, and privacy safeguards across all facets of the project, covering both data uses and the associated vendors and products.

No. The Privacy Office’s evaluation is just one component of the broader Integrated Risk Management workflow. Once we complete our review and submit our privacy findings, the IRM process continues on without us.

Depending on your specific request, the workflow may continue through additional reviewers, including UF IT Security, Procurement, Accessibility (EIT), Legal Counsel, or export control officers. A privacy approval or sign-off does not equal final IRM completion—your unit must wait for official determination and closure from UF IT Security before deploying the product or executing a contract.

Our goal is to complete risk assessments as quickly as possible. However, vendor questions often go unanswered for weeks. To keep reviews moving forward, we have established a clear timeline for follow-ups:

• Day 30: If questions remain unanswered after 30 days, we will post an inquiry in the risk assessment asking if the request is still active.
• Day 37 (30 days + 1 week): If there is still no response, we will send a final warning notifying you that the request will close in 7 days due to inactivity.
• Day 45: If we receive no reply by the end of the 7-day warning period, the risk assessment will be closed for unresponsiveness.

Setting these timeline expectations prevents assessments from remaining open indefinitely without resolution.

When selecting a third-party software vendor or cloud service, the UF Privacy Office evaluates several key pillars to protect institutional and personal data:

• Data Storage & Transit Locations: Where will UF data reside physically and virtually? Is data encrypted both in transit and at rest?
• Physical & Technological Safeguards: Does the vendor enforce strict access controls, robust encryption protocols, identity management, multi-factor authentication, and audited security controls (e.g., SOC 2 Type II reports)?
• Regulatory Compliance: Can the vendor guarantee compliance with applicable U.S. federal and state privacy laws? Key frameworks include:
  • FERPA (Family Educational Rights and Privacy Act) for student education records. For more detailed guidance, please review the following resources:
    
    FERPA Data Protection Guide (0.1 MB): This document explains what constitutes FERPA-protected data, distinguishes between directory and non-directory information, and outlines the compliance mechanisms (such as executing a FERPA Addendum or obtaining student consent) required during the Integrated Risk Management review process.
    
    UF FERPA De-Identification Guide (0.1 MB): This guide provides a step-by-step standard operating procedure for faculty to properly de-identify student assignments (by removing direct identifiers, indirect identifiers, and metadata) so the work is no longer subject to FERPA regulations.
    
  • HIPAA (Health Insurance Portability and Accountability Act) for Protected Health Information (PHI).
  • Florida State Laws & Regulations regarding public records, personal identifying information (specifically the Florida Information Protection Act, or FIPA), and state data security standards.

The University of Florida is a global research university. Just as the United States enforces strict privacy regulations, foreign jurisdictions maintain their own legal frameworks governing personal data (such as the EU's GDPR or China's PIPL).

• International Data Flows: If your unit recruits international students, collects research data from subjects abroad, or collaborates with foreign institutions, foreign data privacy laws apply to that data.
• Vendor Obligations: The vendor’s server locations and backup data centers must comply with the local privacy laws of the regions where data subjects reside.
• Bulk Sensitive Data: In compliance with U.S. Department of Justice (DOJ) regulations, UF must protect bulk U.S. sensitive personal data (such as health, financial, genomic, biometric, and precise geolocation data exceeding specific thresholds) from access by foreign persons or entities from "countries of concern." Understanding a vendor's geographic location and access model helps ensure we avoid restricted data transactions, vendor agreements, or unauthorized data access that violate these national security measures. For more information, please visit the Bulk Sensitive Data page.

For the privacy department's review, your project description must clearly explain how you intend to use the technology in your specific request. A general definition or a website link does not tell us what your risk assessment is seeking authorization to do.

If the description is insufficient, we will request more details, which may increase review time. The more specific and personalized your details are, the better.

Prohibiting an external vendor or AI provider from training on UF data means setting up a strict boundary either enforceable by contractual or technology.

• The vendor cannot reuse, log, or retain UF data to improve, update, or teach its underlying machine learning algorithms or foundation models.

The primary risk is data retention. When a machine learning model trains on data, it permanently absorbs patterns, relationships, and specific details from that input. If an external AI vendor trains its model on UF data, that proprietary or confidential information effectively becomes part of the AI's permanent memory bank.

Fervent support against external AI model training for four critical reasons:

• Intellectual Property Protection: Prevents proprietary code, patentable research data, unreleased academic work, and institutional strategies from becoming publicly accessible or commercialized by third parties.
• Legal and Regulatory Compliance: Ensures the university does not violate stringent privacy laws (such as FERPA, HIPAA, GDPR, or Florida state privacy laws) by inadvertently feeding regulated consumer, student, or patient data into external AI systems.
• Contractual & NDA Obligations: Guarantees that UF honors non-disclosure agreements (NDAs), grant conditions, and clinical trial covenants that mandate strict data confidentiality.
• Institutional Advantage & Data Sovereignty: Keeps UF’s valuable research assets and operational data exclusive to the university, ensuring outside entities cannot profit from or exploit our institutional knowledge.