Classification is just a label that tells people how carefully to handle something. This guidance explains the three levels, how to mark information, and what each level means for storing, sharing and getting rid of it.

Effective Guidance Documents

This guidance document is supplied in fully editable MS Word format and can be easily customised and edited. The document uses pre-defined style formatting throughout, with all text in Calibri font for improved readability.
The following document labelling is included in the footer:

• Guidance number and title
• Information-classification
• Version
• Page number / total pages

alphaZ documents - beautifully designed, tried and tested guidance documents. No junk, jargon or unnecessary content. Simple and usable guidance documents developed over 25 years through practical use in the real world.

Further Reading

Further guidance on information classification and retention:

• Information Classification and Protection
• Information Classification
• Records Management and Retention
• Information Security knowledge base

How to Download

To get access to these files please click on Add to Cart to purchase for immediate download. If you have an alphaZ Subscription just click on Download Files to view all the files available to download. 

Need Help Implementing?

If you'd like hands-on help setting up information classification and your information assets register, our remote support services provide direct expert input from our team, by the day, by project, or on an ongoing basis.

Information Classification and Protection Guidance

A general guidance document on classifying and protecting information, for all employees who create, store or share company information. It explains why information is classified, what counts as an information asset, the Confidential, Business Use and Public levels, how to mark and handle each one, personal data, reviewing a classification and disposal.

Topics Covered

• Why information is classified - how a classification decides storage, access, sharing, retention and disposal, so protection matches how sensitive information is
• Information assets - the many forms information takes, from paper and USB sticks to AI tools, whiteboards and call recordings
• The classification levels - the Confidential, Business Use and Public levels with examples, and treating uncertain information as the higher level
• Marking information - footer markings, marking emails and spreadsheets, and why AI output carries the classification of its source
• Handling by classification - how information at each level is stored, shared, printed, used in AI tools and disposed of
• Personal data - why personal data is confidential by default, the types needing more protection, and the personal data register
• Reviewing a classification - how sensitivity changes over time, such as tender pricing once the tender closes, and when to review
• Disposal and handling errors - disposing of information at the end of retention, remembering the copies, and reporting information handled at the wrong level

Who Is It For?

All employees who create, store, share or dispose of company information, whatever form it is in.

Included in the GDPR / Data Protection Toolkit

This guidance document is part of the GDPR / Data Protection Toolkit - the registers, forms, policies, procedure and guidance for documenting how you collect and process personal data, in one download. The TT-8-07 Information Classification and Protection training talk that carries it is also part of the ISO 27001 and ISO 22301 toolkits.

Using the Guidance

Issue it at induction, go through it with the matching training talk, and keep it as a reference for anyone creating, marking or sharing documents. Record who has received it, for example on the training matrix.

Handling Rules for Each Level

For each classification level the guidance gives clear handling rules. Confidential information is stored where access is restricted, encrypted when sent outside the company or held on a mobile device, and only entered into an AI tool approved for it. Business Use information is kept within the company and checked before it goes outside, and Public information can be shared freely once it has actually been issued.

Adapting the Guidance

Edit the guidance to match your own arrangements - the classification terms set in your policy procedure, examples that fit your business, your approved AI tools and storage locations, and your secure disposal methods.

Related Documents

Other documents that work alongside this guidance:

• PP-8-12 Information Classification and Protection Policy Procedure
• F-IMS25 Information Assets Register
• F-IMS24 Personal Data Register
• P-91 Data Retention Policy
• GG-1-08 Management of Files, Documents and Records
• GG-8-06 Information Transfer