DATA CLASSIFICATION AND HANDLING POLICY
Legal name of the entity
Effective Date
Policy Owner Name or role (for example DPO or CISO)
Scheme Four levels Basis
ISO/IEC 27001 A.5.12 and A.5.13 DPDP Act, 2023 GDPR This policy classifies information by sensitivity and sets the handling rules for each level, so that controls are proportionate to risk.
1. Purpose and scope
This policy applies across Legal name of the entity and is owned by Name or role (for example DPO or CISO) . It covers information in all forms.
2. Classification levels
Information is classified as follows:
Level Description Handling Public Approved for public release No restriction Internal For internal use Share within the organisation only Confidential Sensitive business or personal data Access on need-to-know; encrypt in transit Restricted Highly sensitive (for example special-category or card data) Strict access, encryption at rest and in transit, logging
3. Handling controls
Labelling: to be implemented. Restricted data encryption: to be implemented. Disposal follows the data retention schedule.
4. Review and approval
Reviewed [cycle]; approved by Name and designation on [date].
Approved by
Name and designation
______________________
Policy Owner
Name or role (for example DPO or CISO)
______________________