A information and classification handling policy is a simple policy that sets out the levels of data classification and what you can and cannot do with the information of those types.

There as many levels of classification as are appropriate for the business. It is our recommendation to keep it simple and in most cases we would advise 3 levels of data classification being Confidential, Internal and Public.

The 3 levels of information classification that are the most common are Confidential, Internal and Public.

You can download a trusted Information Classification Handling Policy template from us.

Yes. You need an information classification and handling policy for ISO 27001.

The Information Classification and Handling Scheme provides guidance on the classification of information and the different levels of security required.

Information classification in ISO 27001 is the process of assessing data for its importance and sensitivity and assigning the level of protection that data should be given.

Data is assigned owners, called Data Owners, and it is the Data Owners that decide the data classification.

A data owner is the person that is responsible for the data. All data is assigned and owner.

A data owner decides on the data classification, the data retention, the level of protection, the data controls and is responsible for approving access to the data.

Yes, data classification is required for GDPR.

Yes, data classification is required for data protection.

The main benefit of data classification is that it allows us to protect the data that is most important to us by prioritising our resources and control efforts.