SENSITIVE INFORMATION PROTECTION

Card Holder Information

“The DLP pilot initiative supports the University’s ongoing Payment Card Industry Data Security Standard (PCI DSS) compliance program to support the reduction of unnecessary digital storage of payment cardholder information.” This initiative is led by Central PCI Office that is a joint collaboration of Financial Services and Information Security.

Payment card information is classified as Level 4 information and requires appropriate safeguards
when it is accepted for payments for services and goods across the University.

Data Loss Prevention (DLP) controls for payment card information will be introduced within Microsoft 365 services,
including Outlook, Teams, SharePoint, and OneDrive.

The DLP controls for credit card in the pilot will be phased:

• • An initial 60-day audit phase, during which users will see policy tips designed to increase
    awareness and provide guidance on protecting payment card information.
  • A subsequent 90-day period, during which additional protection controls will be introduced.
    Where there is a legitimate business requirement, users may override certain restrictions by providing an
    appropriate justification.
  • Following these phases, the sharing and transmission of credit card information through Microsoft 365 services
    will be blocked for participating pilot users, subject to established University processes.

Visit PCI Merchant Hub – Home for details and guidelines on handling payment card information.

Social Insurance Number

Social Insurance Numbers (SINs) are classified as Level 4 information and require a high level of protection. As part of this pilot, DLP controls for SINs will be introduced within Microsoft 365 services, including Outlook, Teams, SharePoint, and OneDrive, for participating user groups within Ontario Institute for Studies in Education (OISE), Temerty Faculty of Medicine, and Information Technology Services.

During the pilot, users will continue to be able to share SINs. When a SIN is detected, users will receive an alert reminding them that they are handling sensitive information and prompting them to consider whether the
information needs to be shared and whether it is being handled through the appropriate channel.

Please see the following guidelines on handling SIN:

• • HR Guideline on the collection and retention of Social Insurance Numbers: https://uoft.me/sin-guide
  • Interpretive guidance on handling of social insurance numbers (SINs)
    
  • For more details on Data Classification please see: Information/Data Classification Standard:
    https://uoft.me/dcs

INFORMATION SESSIONS & RESOURCES

 

To help you prepare for these changes, Microsoft DLP information sessions will be held on October 7 and 8, 2026. Visit the Purview Support Centre for-session details, FAQs, training videos, end-user documentation, support contacts, and other helpful resour

PROJECT GOVERNANCE

Executive Sponsors 

Nathan Corwin – Chief Information Security & Digital Trust Officer 

Anthony Tia–PCI Office & Executive Director of Treasury and Investment Services   

Kanupriya Kerjiwal – Associate Director, Information Security, Governance & Risk Compliance 

Swetlana Signarowski – Executive Director, Enterprise Applications & Solutions Integration   

Marden Paul – Director Planning, Governance & Assessment 

Cherilyn Nobleza – Executive Director, HR Transformation & Analytics 

Vicki Vokas – Associate Director, Enterprise Shared Services 

 

Implementation Working Group  

Area of Expertise	Name	Area of Expertise
Initiative Leads	Kanupriya Kejriwal  Vicki Vokas  Marden Paul	ITS – Information Security  ITS –M365   ITS – Data Governance
Security / Privacy	Andrew Wagg  Jesse Beard  Ashley Langville  Kelly Carmichael	ITS Information Security & Compliance    Privacy Office/Legal
UOfT Technical Lead M365	Ahmad Sameem	EASI ITS – M365
Medicine & OISE Leads	Masi Benawa  Dinushy Elamurugan	Medicine – M365 Technical SME  OISE M365 Technical SME
End User Enablement	Lobsang Wangmo	Service Engagement & Co-Ordinator of  M365 End User Delivery
UofT Technical SME’s	Sebastian Bisciglia  Ahsen Subhani	Pharmacy Technical Lead   Arts & Science Technical SME
Project Manager	Farah Ally	Project Management

 

M365 Advisory Working Group 

Area of Expertise	Name	Role
Institutional Data Governance	Yulia Cherevko	Assistant Director, Data Governance
Student Information Technology	Dan Pettigrew	Director Admin System & Associate Registrar, APSC
UTARM	Tys Klumpenhouwer	University Archivist
Legal	Sarah Lowy	Legal Counsel and Director UPO
Information Technology	Hy Luo	Manager Digital Products & Delivery Services I & ITS, UTM
Information Technology	Lareza Lazuardi	Senior Manager, Applications & Development, IIT Faculty of Arts & Science
Information Architecture	Entela Voka	Data Architect, Temerty Faculty of Medicine
Technology & Business Transformation	Ravneet Kaur	Director Strategy and Business Transformation, UTSC
Technology & Business Transformation	Steven Rupchand	Product Analyst, IT UTSC
Technology & Product Delivery	Kate Park	Service & Product Delivery Lead, IIT, Faculty of Arts & Science