Classification policy

Data Classification Policy Development

Overview

A data classification policy establishes the enterprise-wide framework for categorising data by sensitivity level and prescribing handling requirements per tier. The policy translates GDPR classification obligations (personal, special category, criminal) and information security requirements (confidentiality, integrity, availability) into practical, enforceable rules that govern how data is stored, transmitted, accessed, and disposed of throughout its lifecycle. This skill covers the design, implementation, and enforcement of a four-tier classification scheme aligned with GDPR requirements and ISO 27001 Annex A controls.

Classification Tier Structure

Four-Tier Model for Vanguard Financial Services

Tier	Label	Description	GDPR Mapping	ISO 27001 Mapping
Tier 1: Public	PUBLIC	Information approved for public release. Disclosure carries no risk to the organisation or individuals.	Anonymised data (Recital 26), published reports, public filings	A.8.2 — Unclassified/Public
Tier 2: Internal	INTERNAL	Information for internal use only. Disclosure would cause minor inconvenience but no significant harm.	Pseudonymised aggregate data, internal procedures, organisational charts	A.8.2 — Internal
Tier 3: Confidential	CONFIDENTIAL	Information whose disclosure would cause significant harm to individuals or the organisation.	Personal data (Art. 4(1)), financial data, customer records, employee records	A.8.2 — Confidential
Tier 4: Restricted	RESTRICTED	Information whose disclosure would cause severe harm, regulatory sanction, or irreversible damage.	Art. 9 special category data, Art. 10 criminal data, trade secrets, regulatory investigation data	A.8.2 — Restricted/Secret

Classification Decision Matrix

Data Type	Tier	Rationale
Published annual report	PUBLIC	Approved for public disclosure
Internal org chart	INTERNAL	No individual harm from disclosure, but not intended for external distribution
Customer name and email	CONFIDENTIAL	Personal data — disclosure would breach GDPR obligations
Customer account number and transactions	CONFIDENTIAL	Personal data with financial sensitivity
Employee National Insurance Number	CONFIDENTIAL (borderline RESTRICTED)	High-sensitivity direct identifier
Employee health records	RESTRICTED	Art. 9 special category data
Biometric access templates	RESTRICTED	Art. 9 biometric data
Criminal background check results	RESTRICTED	Art. 10 criminal data
AML investigation files	RESTRICTED	Criminal data + legal privilege
Board strategic plans	RESTRICTED	Commercial sensitivity
Encryption keys and credentials	RESTRICTED	Security-critical

Handling Procedures Per Tier

Tier 1: PUBLIC

Control	Requirement
Storage	No restrictions; any approved platform
Transmission	No restrictions; may be sent via any channel
Access control	No restrictions; accessible to all
Encryption	Not required (but recommended for integrity)
Retention	Per document retention schedule
Disposal	Standard deletion
Labelling	Label: "Public" or no label required

Tier 2: INTERNAL

Control	Requirement
Storage	Vanguard-managed systems only (no personal devices, no personal cloud)
Transmission	Vanguard email or approved collaboration tools; not via personal email
Access control	All Vanguard employees and approved contractors with valid account
Encryption	Required in transit (TLS 1.2+); recommended at rest
Retention	Per document retention schedule
Disposal	Standard secure deletion (file system delete)
Labelling	Label: "Internal" applied via header/footer or metadata

Tier 3: CONFIDENTIAL

Control	Requirement
Storage	Vanguard-managed systems with access controls; encrypted at rest (AES-256)
Transmission	Encrypted email (TLS 1.3 or S/MIME); approved SFTP; no unencrypted channels
Access control	Role-based access control (RBAC); business need-to-know; MFA required
Encryption	Required at rest (AES-256) and in transit (TLS 1.3); field-level encryption for high-sensitivity fields
Printing	Permitted with secure print release; printed copies secured in locked cabinets
External sharing	Permitted only with approved third parties under DPA/NDA; DPO approval for new recipients
Retention	Per data-specific retention schedule; automated enforcement
Disposal	Secure overwrite (NIST 800-88 Clear); shredding for physical media
Labelling	Label: "Confidential" in document header/footer, email subject tag, and metadata
Audit	Access logged; quarterly review of access permissions
DLP	DLP policies active: warn on external sharing, block sharing to personal email

Tier 4: RESTRICTED

Control	Requirement
Storage	Designated restricted-access systems only; encrypted at rest with customer-managed keys; separate network segment or HSM where applicable
Transmission	End-to-end encrypted channels only; no email without encryption; approved secure file transfer only
Access control	Named individual access lists (not role-based); dual-person authorisation for bulk access; MFA required; privileged access management (PAM)
Encryption	AES-256 at rest with customer-managed keys; TLS 1.3 in transit; field-level encryption mandatory
Printing	Prohibited unless specifically authorised by DPO; watermarked with user identity
External sharing	Prohibited unless DPO and Chief Privacy Officer jointly approve; encrypted transfer only
Retention	Strict retention with automated deletion; no extensions without DPO approval
Disposal	NIST 800-88 Purge (cryptographic erasure or physical destruction); disposal certificate required
Labelling	Label: "Restricted" in document header/footer (red), email banner, and metadata; visual marking on screens
Audit	All access logged with user identity, timestamp, and purpose; monthly audit review by DPO
DLP	DLP policies active: block all external sharing, block USB copy, block print, block screenshot; alert DPO on policy trigger
Incident response	Any unauthorised access or disclosure treated as data breach; immediate DPO notification

Policy Governance

Policy Document Structure

Section	Content
1. Purpose and Scope	Defines why classification is required and what data is covered
2. Classification Tiers	Four-tier definitions with examples
3. Roles and Responsibilities	Data owner, data steward, DPO, IT Security, all employees
4. Classification Procedures	How to classify new data, reclassification triggers
5. Handling Requirements	Per-tier controls matrix
6. Labelling Requirements	How to apply labels (manual and automated)
7. Exception Process	How to request exceptions with risk acceptance
8. Enforcement	Monitoring, audit, and consequences for violations
9. Training	Classification awareness training requirements
10. Review Schedule	Annual review; interim reviews on regulatory change

Roles and Responsibilities

Role	Responsibility
Data Owner (business unit head)	Classify data for their business function; approve access requests; review classifications annually
Data Steward (departmental)	Maintain classification labels; ensure handling compliance in their area; report classification issues
DPO	Oversee policy compliance; approve Restricted tier exceptions; conduct classification audits
IT Security	Implement technical controls per tier; manage DLP policies; configure encryption; monitor audit logs
All Employees	Apply classification labels to data they create; handle data per tier requirements; report suspected misclassification
Privacy Engineering	Configure automated classification tools; manage discovery platforms; tune detection accuracy

Exception Process

Exception Request
  │
  ├─► Step 1: Requestor documents the exception
  │     - What data? What tier? What control cannot be met?
  │     - Why is the exception needed?
  │     - What alternative controls are proposed?
  │     - Duration of exception requested
  │
  ├─► Step 2: Risk Assessment
  │     - Data Steward assesses the risk of the exception
  │     - For Confidential tier: Data Owner approves
  │     - For Restricted tier: DPO and CISO jointly approve
  │
  ├─► Step 3: Approval and Documentation
  │     - Exception recorded in exception register
  │     - Alternative controls documented and implemented
  │     - Expiry date set (maximum 12 months, renewable)
  │
  └─► Step 4: Review
        - Exception reviewed at expiry
        - Renewed only if original justification remains valid
        - Chronic exceptions trigger process improvement

Enforcement Mechanisms

Mechanism	Implementation
Automated labelling	Microsoft Purview auto-labelling applies Confidential/Restricted labels based on detected PII
DLP policies	Microsoft Purview DLP blocks or warns on policy violations (external sharing, USB copy)
Access reviews	Quarterly certification of access permissions for Confidential; monthly for Restricted
Audit logging	All access to Confidential and Restricted data logged and retained for 2 years
Classification audits	DPO conducts semi-annual audits sampling 100 items per tier for classification accuracy
Training compliance	Annual classification training required for all employees; completion tracked in LMS
Disciplinary policy	Violations escalated per employee handbook: warning → formal warning → disciplinary action

Enforcement Precedents

• ICO v Interserve Group (2022): GBP 4.4 million fine for inadequate security measures — the ICO noted that failure to classify data by sensitivity contributed to the inability to apply proportionate security controls, leading to a breach affecting 113,000 employees.
• CNIL v Sergic (2019): EUR 400,000 fine for failing to implement adequate access controls on tenant personal data — absence of data classification meant all data was treated with the same (insufficient) controls.
• AEPD v CaixaBank (2021): EUR 6 million fine — the DPA noted that inadequate data classification contributed to excessive data collection and retention, violating data minimisation and storage limitation principles.

Integration Points

• personal-data-test: Classification policy tiers are assigned based on personal data classification results
• special-category-data: Art. 9 data automatically assigned Restricted tier
• criminal-data-handling: Art. 10 data automatically assigned Restricted tier
• data-labeling-system: Labelling system implements the policy's labelling requirements
• auto-data-discovery: Discovery tools validate that classification labels match detected data sensitivity