Information Classification and Handling Policy

1. Purpose

Not all information needs the same protection. This policy sorts information into a small number of levels according to the harm its loss, leak or alteration would cause, and sets the handling rules for each level so that effort and cost go where the risk is highest and people know exactly what to do without having to decide each time.

The labelling steps, templates and tooling are in the Information Classification and Handling Procedure.

2. Scope

• In scope: all information created, received, stored, processed, transmitted or destroyed by or for the Organisation, in any form: electronic, paper, spoken, visual or on media.
• In scope: all staff, contractors and suppliers who handle that information, and all systems and locations where it lives.
• In scope: information belonging to customers and partners which the Organisation holds, which is classified according to the owner's marking or, where none, by this scheme.
• Out of scope: the content decisions of what to publish, which follow the communications approval process. Once published, items are Public.

3. Terms and definitions

4. Roles and Responsibilities

5. Classification Levels

Four levels are used. When information fits two levels, the higher applies. Information without a label is treated as Internal until its owner classifies it.

6. Classification Principles

• The information owner assigns the level when information is created or received and records it in the label or the register.
• Classification reflects confidentiality first. Integrity and availability needs are recorded separately for the system through the risk assessment.
• Compilations take the highest level of any item, and may be raised where combination increases sensitivity, for example a list of names with contact details and financial data.
• Levels are reviewed when the information is reused, when its purpose changes, at least [every 12 months] for Confidential and Restricted, and when it ages: for example, results announced publicly cease to be Confidential.
• Customer information is at least Confidential. Personal data is at least Confidential, and special categories or large volumes are Restricted.
• Over-classification is discouraged because it dilutes protection. The owner must be able to explain the harm that justifies a level.

7. Labelling

• Documents carry the level in the header or footer of every page, or as a watermark for Restricted material. Electronic files also use metadata or tool-based sensitivity labels where available.
• Emails with Confidential or Restricted content carry the level in the subject line or banner. Systems and databases carry the level in the asset register.
• Media such as drives and tapes, and printed copies, carry a physical label. Physical folders are marked on the cover.
• Information from outside the Organisation is labelled on receipt according to the sender's marking and the Organisation's equivalent level.
• Verbal information, such as in meetings and calls, is announced at the start when it is Confidential or Restricted.

8. Handling Rules by Level

The rules apply to every copy and every state of the information: storage, use, transfer and destruction. Stricter rules from contracts or law override this table.

9. Handling Rules in Specific Situations

9.1 Information shared with customers and partners

• Sharing needs a business purpose, the owner's approval and a confidentiality undertaking or contract clause. Only the needed items are shared.
• Customer data is used only for the services the customer agreed to. It is not used in testing or training unless masked or anonymised.
• Where a customer or partner has its own classification scheme, its marking is honoured and mapped to a level here in the contract.

9.2 Personal data

Personal data follows the Data Protection and Privacy Policy as well. Its transfer, storage and sharing must satisfy the Digital Personal Data Protection Act, 2023 and its Rules [confirm the current requirement], and applicable law in each jurisdiction where the Organisation operates (such as the EU General Data Protection Regulation). Questions go to the data protection lead.

9.3 Cloud and collaboration tools

• Confidential and Restricted information is stored only in tools approved for that level under the Cloud Computing Security Policy and Procedure.
• Public links and anonymous sharing are turned off for Confidential and Restricted content.
• Generative AI tools are not approved for Confidential or Restricted information unless the Employee AI Usage Policy permits it for that tool.

9.4 Meetings, calls and public places

• Confidential matters are discussed only in places where they cannot be overheard, and not in lifts, public transport or open cafes.
• Screen sharing is checked before use to avoid displaying unrelated information.
• Recordings of meetings take the highest level of any content discussed.

9.5 Incidents and mishandling

Anyone who sends information to the wrong person, loses a device or document, or finds information mislabelled or exposed must report it at once through [the incident reporting channel]. Delay makes harm worse. Reports made promptly in good faith are treated as learning, not as blame.

9.6 Declassification and destruction

• Only the information owner may lower a level, with a note in the register of who approved it and why.
• At the end of its retention period, information is destroyed under the Documents and Records Management Procedure, unless a legal hold applies, using the method for its level.
• Media are sanitised or destroyed under the Asset Disposal Process.

10. Compliance and monitoring

Compliance is checked by data loss prevention alerts, label coverage reports, periodic sampling of documents and shares, and internal audit. Results are reported [quarterly] by the Head of IT Security to top management.

11. Records and evidence

• Classification register for systems and information stores, with owner and review date: kept while current and [3 years] after.
• Records of declassification approvals and external sharing approvals: [3 years].
• Data loss prevention alerts, label reports and sampling results: [12 months].
• Disposal and destruction certificates: [5 years].

Annexure A: Classification quick guide

12. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

13. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

14. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Information Classification and Handling Procedure
• Access Control Policy
• Cryptography Policy
• Data Protection and Privacy Policy
• Documents and Records Management Procedure
• Data Governance Policy
• Asset Disposal Process