Training Course 1-APPENDIX B - Data Classification and Handling Guidelines

APPENDIX B - Data Classification and Handling Guidelines

Pdf Summary

The document is Oakleaf’s Data Classification and Handling Guidelines, which define a four-tier information classification system: Restricted, Confidential, Private, and Public.<br /><br />Restricted data is the most sensitive and typically includes legally or contractually protected information such as PII/NPI, certain contracts, and loan documentation. Loss of Restricted data could cause significant damage, including regulatory violations, reputational harm, and lawsuits. Handling is very strict: encryption is required, cloud and mobile storage are prohibited, email must be encrypted, faxing and copying are prohibited, printing is tightly controlled, and release to third parties requires CEO or Managing Director approval plus an NDA.<br /><br />Confidential data is highly sensitive internal information such as employee PII/NPI, payroll, accounting, and financial data. Loss could cause moderate damage. It must be encrypted at rest, cannot be stored on mobile devices, may be stored in secure cloud storage, and external transmission must use encrypted email or SFTP. Printing and copying require permission; faxing is prohibited.<br /><br />Private data is the default classification for information created or received by employees unless otherwise designated. It may be shared internally with authorized users and can be transmitted with fewer restrictions, though encryption is recommended for external transmission. Disposal and labeling requirements are less stringent than higher classifications.<br /><br />Public data may be freely shared internally and externally and has no special handling requirements.<br /><br />The policy also defines NPI/PII as a name plus certain identifiers such as government ID numbers, SSNs, driver’s licenses, account numbers, or ePHI. It provides examples of classified data types across client, employee, marketing, infrastructure, and financial information, and notes that client-specific requirements may apply.

Keywords

data classification

restricted data

confidential data

private data

public data

PII

NPI

encryption

information handling

Oakleaf policy