Data Handling & Classification

Not All Data is Created Equal

Every organization handles data ranging from completely public information to highly sensitive secrets. A company blog post and a customer's Social Security number both live on company systems, but they need very different levels of protection. Data classification gives everyone a shared vocabulary and clear rules for how to handle each type.

Without classification, people guess. And when people guess, mistakes happen — sensitive customer records get emailed to the wrong person, confidential financial reports end up in shared folders, or internal strategies get discussed in public coffee shops.

The Four Classification Levels

Most organizations use a system similar to this:

Public

• Definition: Information intended for public consumption
• Examples: Published blog posts, press releases, marketing materials, job postings
• Handling: No restrictions on sharing. Can be posted on websites, social media, or shared with anyone.

Internal

• Definition: Routine business information not intended for the public
• Examples: Internal memos, org charts, meeting notes, internal policies, project timelines
• Handling: Share freely within the organization. Don't post externally or share with outsiders without approval.

Confidential

• Definition: Sensitive business information that could cause harm if disclosed
• Examples: Financial reports, employee records, customer lists, contracts, strategic plans, source code
• Handling: Share only with authorized personnel on a need-to-know basis. Encrypt when sending externally. Store in access-controlled locations.

Restricted

• Definition: Highly sensitive data subject to regulatory requirements or with severe impact if disclosed
• Examples: Social Security numbers, credit card data, medical records, trade secrets, authentication credentials
• Handling: Strictest controls. Encrypt at rest and in transit. Access limited to specifically authorized individuals. Log all access. Never send via regular email.

Handling Data: The Rules That Matter

Sharing and Transmission

Storage

• Public and Internal — Standard company file shares and approved cloud storage
• Confidential — Access-controlled folders, encrypted drives, approved systems with audit logging
• Restricted — Dedicated secure systems with encryption at rest, multi-factor access, and full audit trails

Disposal

When you no longer need data:

• Digital files — Use secure deletion tools (not just "Delete" which moves to the Recycle Bin)
• Printed documents — Cross-cut shred Confidential and Restricted documents. Regular recycling is fine for Public and Internal.
• Storage devices — Hard drives and USB drives containing Confidential or Restricted data must be securely wiped or physically destroyed

When You're Not Sure

If you're unsure how to classify or handle specific data:

1. Ask your manager — They can help determine the appropriate classification
2. Check your company's data classification policy — Most organizations publish detailed guidelines
3. When in doubt, treat it as Confidential — Over-protecting data is far better than under-protecting it
4. Contact your security team — They exist to help, not to judge

Key Takeaways

• Know the four levels — Public, Internal, Confidential, and Restricted each have specific handling rules
• Classify before you share — Always consider the data's sensitivity before sending, storing, or printing it
• Encrypt Confidential and Restricted data — Especially when sharing externally or storing in cloud systems
• Get written approval for external sharing — Verbal approvals don't create an audit trail
• When in doubt, protect it — Treating data as more sensitive than necessary is always safer than the alternative
• Shred, don't recycle — Sensitive printed documents need cross-cut shredding, not the recycling bin