Data classification policy for small organizations
A simple four-level scheme, with handling rules for each level, lets staff make the right call on sharing, storage and email without a manual, and maps straight onto sensitivity labels in Microsoft 365.
Reviewed by the ITRS security team · Last updated
Why classify
You cannot protect everything to the highest standard, and you should not try. Classification tells staff and systems which information needs extra care, so security effort goes where the harm would be. It is also the foundation for other controls: retention, AI acceptable use, external sharing, data loss prevention and breach assessment all work better when you know what a document is.
ISO/IEC 27001:2022 includes information classification and labelling among its Annex A controls, and PIPEDA's safeguards principle asks for protection appropriate to the sensitivity of the information. A classification policy is how a small organization puts both into practice.
Four practical levels
Four levels is enough. More levels produce hesitation and mislabelling; fewer cannot distinguish routine client work from the information that triggers a breach report.
| Level | Meaning | Examples |
|---|---|---|
Public | Approved for anyone to see | Website content, published brochures, job postings |
Internal | Normal business information; minor harm if leaked | Policies, internal memos, most project correspondence |
Confidential | Would harm clients, staff or the business if disclosed | Client files, contracts, pricing, personal information, financials |
Restricted | Serious harm; tightly limited to named people | SINs, banking and health details, legal advice, M&A, security configurations, credentials |
Handling rules per level
| Rule | Internal | Confidential | Restricted |
|---|---|---|---|
Storage | Company systems only | Company systems with access limited to the team or matter | Named-access locations; never on personal devices or USB drives |
Sharing outside | With a business reason | Named guests or secure links that expire | Only with approval; encrypted |
Email | Normal | Check recipients; encrypt if sensitive personal information | Encrypted; avoid as attachments where possible |
AI tools | Approved tools only | Approved business tools only, per AI policy | Not permitted |
Printing | Normal | Collect immediately; shred | Avoid; shred |
Disposal | Normal deletion | Per retention schedule | Per retention schedule; secure destruction recorded |
Who classifies and when
The person who creates or receives information is responsible for classifying it, with defaults to make that easy. Set a default of Internal for new documents and email, and default Confidential for locations such as client file libraries or the HR site, so most items are classified correctly without anyone thinking about it.
Owners of each data category (finance, HR, client service) decide edge cases and review the scheme each year. When in doubt, staff choose the higher level and ask.
Mapping to technical labels
In Microsoft 365, Microsoft Purview sensitivity labels can carry the policy into the files themselves. A label can apply encryption and content markings such as headers, footers and watermarks; for example, a 'Confidential' label can encrypt a document and add a 'Confidential' watermark. Labels can also be applied to Teams, Microsoft 365 groups and SharePoint sites to control privacy and external sharing.
Keep labels identical to policy names so staff see the same four words everywhere. Start with visual markings only, add encryption to Restricted once people are used to it, and test how encrypted files behave with clients and external tools before you switch it on broadly.
Classification questions
No. Classify locations first (the HR site, client libraries), apply defaults to new content, and let older material be classified by where it sits. Bulk labelling of historical content can come later, if at all.
They can, if the client is not covered by the label's permissions or uses software that does not support it. Test with real clients before applying encryption to anything sent externally.
It speeds up the first question every investigator, insurer and lawyer asks: what kind of information was in the affected mailbox or folder? A labelled environment answers it faster and with more confidence.
Rollout
We help organizations design classification schemes and configure sensitivity labels that match them.
Agree the four levels and examples
With department heads, using your own documents as examples.
Set location defaults
Classify the obvious repositories first: HR, finance, client files.
Publish labels
Visual markings first, to a pilot group, then everyone.
Train in fifteen minutes
The four levels, three examples each, and where to ask.
Add protection
Encryption and sharing limits for Restricted; data loss prevention rules where licensed.
Review yearly
Check label usage, mislabelled items and new data types.
Related reading.
- GuideGetting started with sensitivity labelsSensitivity labels tell people, apps and Copilot how sensitive a document or email is, and can enforce encryption and access rules that travel with the file.
- GuideBuilding a records retention scheduleKeeping everything forever feels safe until a breach exposes ten years of client files, or a litigation hold has to search all of it.
- GuideAI acceptable use policy: what to includeStaff are already using generative AI tools. A short, clear acceptable use policy tells them which tools are approved, what information must never go in, who is…
- PracticePrivacy, Data Governance & AIPIPEDA and Quebec Law 25 readiness, data mapping, breach notification and AI governance.
Not sure what your obligations require of your systems?
Speak with our privacy practice. We are staffed 24/7. Active incident? Call (289) 582-9930, 24/7.