A data classification policy is one of the shortest documents in an information security program and one of the most often skipped. Without it every file gets treated the same way, so either everything is locked down and work slows, or nothing is and sensitive data ends up in the wrong place. Here is how we set one up with Australian teams.
1. Choose three or four levels
More levels do not make a better policy, they make one nobody remembers. A common set is public, internal, confidential and restricted. Write each level in plain words and give an example staff will recognise: a published price list is public, a team meeting agenda is internal, payroll files and customer contracts are confidential, and health records or credentials are restricted.
2. Write handling rules next to each level
A label means nothing without instructions. For each level, state where the data can be stored, who can access it, whether it can be emailed or shared outside the company, whether it must be encrypted, and how it is destroyed. Keep this to a single table so people can check it in a few seconds.
3. Give every data set an owner
Classification should be decided by the person who understands the data, not by IT. Assign an owner to each data set, such as customer records or financial reports, and have them set its level. Where nobody decides, treat unlabelled data as internal so work is not blocked.
4. Link it to your risk register
The level drives how much protection a data set needs, so it belongs in your risk assessment. Restricted data with weak access controls is a high-rated risk with a named owner and a treatment date. Our ISO 27001 risk register template has the columns to record that.
5. Train staff and spot-check
Brief everyone on the levels, then check once a quarter. Ask a few people what level their own files are. If they cannot answer, the scheme is too complicated and needs simplifying, not a longer training session.
6. Review it every year
Classifications change as systems and suppliers do. Review the policy and the data set levels at least annually, and record the date and approver. Auditors usually ask for that evidence.
If you want a starting draft, our security policy templates page has a short guide to writing one, alongside a starter policy pack. For help applying it, contact Cyber Compliance Pro.
Top comments (0)