Every item you handle has a class. When unsure, treat it as one level higher than you think.
| Class | Examples | Handling |
|---|---|---|
| Public | Marketing, published docs | Free to share |
| Internal | Internal wiki, non-sensitive reports | Tenant members only |
| Confidential | Customer data, contracts, source code | Need-to-know; encrypted in transit + at rest |
| Restricted | Personal data, secrets, keys, health/financial | Strict need-to-know; logged access |
Every data class has a retention timer; data is minimised and deleted on schedule. Do not keep
"just in case" copies - you may be creating an unmanaged, unprotected duplicate.
If you are a data subject, you may access, correct, delete, port, or object to processing of your
personal data. Submit requests through the portal; the team responds within statutory timelines.
We process personal data only under a lawful basis (consent, contract, legal obligation, vital
interests, public task, or legitimate interests) and only for the stated purpose.
is the most common cause of reportable breaches.