Why is this important?
Visitors need to be confident our sites are secure and their privacy is protected.
Legislation and policy
McGill staff are subject to Quebec and Canadian laws and McGill University’s policies concerning information security and maintaining the confidentiality of personal information.
In addition, anyone who processes, transmits or stores credit cards information in an unsecure and unauthorized manner may be found in violation of financial confidentiality laws and expose themselves to legal liability. If you need to collect payment, please get in touch with Financial Services.
Christopher Manfredi, Provost and Vice-Principal Academic, describes the responsibility of all academics to uphold McGill's information security
Visit McGill’s cybersecurity website Secure your journey for additional tools and resources.
Checklist of things to do
- Create secure webpages and webforms that properly protect users' personal data (e.g. use secure formats and platforms like https, adhere to recommendations for building secure webforms)
- Do not display or email people's confidential information (unless it's using McGill's official email)
- Do not identify student names without their written consent, e.g. on Research web pages, do not list student participants
- If you become aware of unsafe practices or vulnerabilities, notify IT Security
- Keep web systems and tools up to date
- Ensure your site has a designated sponsor/asset steward
- Delete/decommission websites when they become inactive and/or are no longer of value
- Update website access permissions accordingly when your web team members change roles, leave your department or leave the university
- Use McGill usernames and passwords for authentication on McGill websites and systems (where possible)
- If authentication is required on McGill websites, it should be performed using one of our preferred Single Sign On (SSO) methods, such as SAML, with McGill’s central identity provider.
- Limit data collection for analytics and user research to interactions around links, buttons and page elements only
- If linking to information in a cloud service, adhere to instructions in McGill's Cloud Directive which describes when and where you can process, transmit and store McGill data
Supporting resources
Related sites
How to create secure webforms
- Create Forms in the Web Management System
- Webform security: Protecting user data
- Webforms and security: Three things worth repeating
Privacy and security policies and guidelines
McGill policies and guidelines site owners and managers should be aware of.
Use of information technology
- Policy on the Responsible Use of Information Technology at McGill, IT Services
- Supporting Guidelines for the Responsible Use policy
- IT Policies, Directives, Regulations and Standards
- IT Security Incident Response
- Guide to secure web service/servers
- Cloud Services at McGill - When acquiring or using a new software app, here's what you need to know...
- Domains and URLs for McGill websites
Privacy and personal information
- Cloud Services at McGill
- Guidance for safe use of cloud applications at McGill
- Information Security Reminder, Enrolment Services
- Information security, IT Services
- IT Governance - Data Classification Document from the Secretary General
- McGill's Cloud Directive
- Privacy Notice, McGill University
- Protection of Personal Information, Student Rights and Responsibilities