# Data Classification & Handling Policy

> **Template — adapt before use.** Replace `[bracketed]` placeholders and have an owner approve it. Not compliance advice.

| | |
|---|---|
| **Owner** | [Role] | **Approved** | [YYYY-MM-DD] | **Review** | Annual | **Version** | 1.0 |

Maps to: ISO 27001 A.5.12–5.14 · SOC 2 CC6 · PCI DSS Req 3 · HIPAA §164.312.

## 1. Purpose & scope
Defines how [Company Name] classifies information by sensitivity and the handling rules for each level.

## 2. Classification levels
| Level | Definition | Examples |
|---|---|---|
| **Restricted** | Severe harm if exposed; often regulated | Cardholder data, ePHI, secrets/keys, credentials |
| **Confidential** | Material harm if exposed | Customer data, financials, source code, contracts |
| **Internal** | Not for public release | Internal docs, most email |
| **Public** | Approved for release | Marketing, published content |

## 3. Handling rules
| Control | Restricted | Confidential | Internal | Public |
|---|---|---|---|---|
| Encrypt in transit | Required | Required | Required | Optional |
| Encrypt at rest | Required | Required | Recommended | No |
| Access | Need-to-know + MFA | Need-to-know | Employees | Anyone |
| External sharing | Approved + contract/DPA | Approved channels | Limited | Allowed |
| Retention/disposal | Per schedule; secure wipe | Per schedule | Per schedule | N/A |

## 4. Responsibilities
Data owners assign classifications; all personnel handle data per its level. Default to **Confidential** when unsure.

## 5. Special categories
Cardholder data and ePHI carry additional obligations (PCI DSS, HIPAA) beyond this policy; never store Sensitive Authentication Data after authorization.

## Revision history
| Version | Date | Author | Change |
|---|---|---|---|
| 1.0 | [YYYY-MM-DD] | [Name] | Initial issue |