Data Classification

The kind of document does not settle the tier: a public summary of a report and its detailed technical appendix may need different labels. The tiers themselves vary between organisations too.

The CompTIA Security+ objectives list classification labels without ranking them: public, private, sensitive, confidential, restricted and critical. They overlap with the four tiers here. Private is usually used for information about individuals, and critical for information the organisation could not operate without. An examination question will describe the information; choose the label from the description.

A label does nothing by itself. Writing “Confidential” on a folder does not change who can open it. The label matters because of the handling rules attached to it, and there are five kinds.

• Who can open it. Give access to people whose job needs it, review it, and remove it when the need ends.
• Where it is kept. Use approved places, and encrypt it where the rules require. Remember backups: information that cannot be recovered has been lost just as surely as information that leaked.
• How it is shared. Check the recipient, send only what is needed and use an approved method. An encrypted email to the wrong person is still a disclosure.
• How long it is kept, and how it is destroyed. Decide why and for how long it is needed, then delete it securely, including copies and backups, unless the law requires it to be kept.
• What staff are told. Make the label and its rules easy to understand, name someone to ask, and give people a way to report a mistake.

The same controls can be grouped by where the information is, or what is being done with it:

The responsibilities overlap. Stored records still need access controls, and secure transmission does not authorise a disclosure. Security Documentation explains how policy, procedure and evidence support consistent handling.

The document passes through seven stages, and a different handling control matters most at each.

Creation → Classification → Access → Storage → Sharing → Retention → Disposal

1. Creation

Define why the attendance record is needed and collect only relevant details. Do not add unrelated health notes simply because the template has a free-text field. Unnecessary information increases exposure and complicates lawful handling if the document is lost or shared incorrectly.

2. Classification

An authorised owner applies the organisation’s rules. Suppose this fictional organisation chooses Confidential because named attendance information needs restricted access. Record the label and owner so staff know which handling rules apply. An incorrect Public label could encourage inappropriate publication; changing the label cannot make a legally restricted use lawful.

3. Access

Give the relevant administrators access and distinguish reading from editing where useful. Tutors should receive only the information needed for their duties. Review access after role changes. Over-broad permissions increase the chance of disclosure or accidental alteration, while unjustified restrictions can prevent necessary work.

4. Storage

Store the document in an approved managed location with permissions, recovery arrangements and suitable encryption. Protect encryption keys and consider downloaded copies. A personal account or unprotected device may bypass monitoring and removal arrangements; a single unrecoverable copy creates an availability risk.

5. Sharing

Before sending an attendance extract, confirm the purpose, recipient and authority to share. Provide only necessary fields through an approved mechanism, checking link permissions and expiry where appropriate. An open link or autocomplete mistake can disclose information despite the Confidential label. A new recipient or purpose may also require a fresh legal assessment; the classification decision is not that assessment.

6. Retention

Apply a documented retention rule based on the purpose and applicable requirements, with an owner and review trigger. The right period depends on the purpose and on the law that applies. Keeping everything indefinitely increases exposure; deleting too early may prevent an organisation from meeting a justified requirement. Check any applicable preservation obligation before disposal.

7. Disposal

When retention is no longer justified and disposal is permitted, securely delete or destroy the relevant records and manage copies and backups through the approved process. A desktop deletion does not prove that shared copies or recoverable storage have been addressed. Record appropriate evidence of disposal without reproducing the personal information unnecessarily.

The result: one document, seven decisions, and a named person responsible throughout. The label “Confidential” was chosen at stage 2, and every later stage is that label being turned into something done. The legal principles behind purpose, minimisation, security and retention are explained in the data-protection principles section.

Classification asks how the organisation should handle information. The legal question asks whether it relates to an identified or identifiable living individual and how it is being processed. A document labelled Internal can still contain personal data and attract data-protection obligations. Conversely, a highly restricted engineering design can be confidential without necessarily containing personal data.

Removing names does not necessarily anonymise a record if people remain identifiable from other details or linked information. Nor does a Public label take personal data outside the law. See the ICO’s personal-information guidance and the legal distinctions.