Data Classification and Retention Policies

Data classification is the practice of labeling data by how sensitive it is, usually as public, internal, confidential or restricted, so that everyone knows how it may be stored, shared and eventually deleted. A data retention policy sets how long each category of record is kept and how it is disposed of. Together they answer the two questions auditors, customers and your own staff ask most: who is allowed to see this, and when can we get rid of it. This guide gives you the four levels with examples, the handling rules that go with each level, a method for setting retention periods, and editable templates for both policies.

This is general information, not legal advice. Retention requirements vary by industry, state and contract; confirm them against the current official text or with counsel before you publish a schedule.

Data classification levels

Four levels cover almost every organization. Three is workable for a very small company (merge internal and confidential); more than four is rarely used in practice because nobody remembers the difference between level four and level five.

Level	Definition	Examples	Impact if exposed
Public	Approved for release to anyone	Website content, press releases, published pricing, job postings	None
Internal	For employees and contractors; not harmful if leaked, but not meant for outsiders	Org charts, internal process documents, meeting notes, most email	Embarrassment, minor competitive loss
Confidential	Business-sensitive; access limited by role or need	Customer contracts and lists, financial statements before release, employee records, source code, product roadmaps, vendor pricing	Financial loss, contract breach, competitive harm
Restricted	Regulated or highly sensitive; access by named individuals with strong controls	Protected health information, Social Security numbers, payment card data, bank account details, passwords and API keys, M&A material, controlled unclassified information on defense contracts	Regulatory penalties, legal liability, identity theft, loss of customers

Regulations decide a lot of the restricted level for you. HIPAA defines protected health information; PCI DSS defines cardholder data; state privacy laws and the GDPR define personal data; CMMC defines controlled unclassified information for defense suppliers. If you need a reference model for impact levels, NIST FIPS 199 uses low, moderate and high and maps well onto the top three levels above. The HIPAA compliance checklist covers what the restricted label means in a healthcare context.

Classify systems and locations as well as records. A spreadsheet of customer SSNs on a laptop is restricted data in an unapproved place, which is the most common finding in a first assessment. Tools help with discovery: Microsoft Purview sensitivity labels classify files and email across Microsoft 365, Google Workspace has label equivalents, and scanners such as Amazon Macie or Purview’s data map find sensitive fields in storage and databases.

Handling rules for each level

A classification level is only useful if it changes what people do. Keep the handling rules few, concrete and testable, and publish them as a one-page matrix.

Rule	Public	Internal	Confidential	Restricted
Where it may be stored	Anywhere	Company-managed systems	Approved systems only	Named approved systems with encryption at rest
Who may access	Anyone	All staff	By role or need, approved by the data owner	Named individuals, reviewed quarterly, MFA required
Sharing outside the company	Allowed	Not allowed without approval	NDA or contract in place; secure share links, not attachments	Only under a written agreement (for example a business associate agreement); encrypted transfer; access logged
Email and messaging	Allowed	Internal only	Internal; external with encryption	No email or chat; use the approved system
Personal devices and removable media	Allowed	Managed devices preferred	Managed devices only	Managed devices only; no removable media
Backups and logs	Standard	Standard	Encrypted backups	Encrypted, access-restricted backups; access logging retained
Disposal	None required	Delete when no longer needed	Secure deletion per retention schedule	Verified destruction per schedule, with a record

Two implementation notes. First, enforce the top row with technology where you can: sensitivity labels that apply encryption, data loss prevention rules that block restricted data in outbound email, and conditional access that requires MFA. Second, give people an approved way to do the thing they will otherwise do badly. If sharing a confidential file externally is forbidden but there is no secure share link, it will travel as an email attachment.

Retention: how to set periods

A retention period is the answer to three inputs. The legal or regulatory minimum sets the floor. Business need may extend it. Risk of holding the data argues for the shortest period that satisfies the first two, because every record you keep is a record that can be breached, subpoenaed or requested under a privacy law.

1. Inventory record categories, not individual files: financial and tax records, contracts, employee records, customer records, medical records, security logs, email, backups, source code.
2. Find the floor for each category. Common drivers in the United States include tax authority guidance for financial records, the HIPAA Security Rule documentation requirement for covered entities and business associates, state medical record laws, employment and payroll record rules, contract terms, and audit standards. Note where you found each one so the next reviewer can check it.
3. Add business need. Warranty periods, litigation exposure, analytics history. Write the reason down; a period with no reason becomes forever by default.
4. Define the trigger. Retention runs from an event: contract end, employee departure, last patient visit, fiscal year close. A period without a trigger cannot be automated.
5. Define disposal. Deletion, anonymization or archival to cold storage, and what happens to copies in backups, email and exports.
6. Write the legal hold rule. A hold notice suspends disposal for the records it names until it is lifted, and it overrides every period in the schedule.

Where the data lives decides how you enforce the schedule. Microsoft 365 retention policies and labels, managed through Purview, keep and then delete email and files automatically; Google Vault does the same for Workspace. Line-of-business systems (ERP, CRM, EHR, ticketing) usually need a scheduled job or an archive routine written by your engineers. Backups follow their own shorter cycle, and your policy should say that a deleted record ages out of backups on that cycle rather than being hunted down copy by copy.

Privacy laws add a second kind of trigger: a verified request from an individual to delete their data. Your schedule should note which categories are in scope for such requests and which legal floors override them, so the person handling the request is not deciding that alone.

Templates

Both templates below are deliberately short. Policies that run to twenty pages are not read; the handling matrix and the retention schedule are the parts people use. Pair them with the broader data governance policy and with the other core documents in IT Policies and Procedures: The 10 Every Company Needs.

Data classification policy template

1. Purpose
   Why the organization classifies data and what the policy protects.
2. Scope
   All data created, received or processed by the organization, in any
   system or format, including data held by vendors on our behalf.
3. Roles
   Data owners (assign levels, approve access), IT or security (enforce
   controls), all staff (handle data per its level), policy owner (reviews).
4. Classification levels
   Public, Internal, Confidential, Restricted: definitions and examples
   (use the table above and add your own examples).
5. Labeling
   How labels are applied (sensitivity labels, document headers, system
   tags) and the default level for unlabeled data (Internal).
6. Handling rules
   The handling matrix: storage, access, sharing, email, devices,
   backups, disposal, per level.
7. Reclassification
   When a level changes (publication, contract end) and who approves it.
8. Exceptions
   How to request one, who approves, how long it lasts, where it is logged.
9. Review
   Annual review, and after any incident or regulatory change.

Data retention policy template

1. Purpose and scope
   Records in all systems and formats, including email, chat, backups
   and vendor-held data.
2. Roles
   Record owners per category, IT (automation and disposal), legal or
   compliance (legal holds, regulatory floors).
3. Retention schedule
   One row per record category:
   Category | System(s) | Trigger event | Period | Basis (law, contract,
   business need) | Disposal method | Owner
4. Legal hold
   Who may issue a hold, how it is communicated, what it suspends,
   how it is lifted.
5. Disposal
   Approved methods (secure deletion, anonymization, archival,
   physical destruction) and the record kept of disposal.
6. Backups and copies
   Backup cycle; rule that deleted records age out of backups; handling
   of exports and personal copies.
7. Privacy requests
   Which categories are subject to individual deletion requests and
   which floors override them.
8. Exceptions and review
   Exception process; annual review; update log.

Fill the schedule with your own periods and the source for each one. If you operate in healthcare, finance, defense or education, start from the regulation that covers you and let counsel confirm the rows before anyone automates deletion.

Where PS3G fits

PS3G writes and implements classification and retention policies as part of data governance services: the inventory of record categories, the levels and handling matrix, the retention schedule, and the automation in Microsoft 365, Google Workspace and line-of-business systems that enforces it. When a customer questionnaire, cyber-insurance form or audit is the trigger, our IT compliance consulting covers the full policy set and the evidence behind it. We build and run our own HIPAA-regulated software, so the restricted-data rules in these templates are ones we live with ourselves. A founder usually needs the two one-page policies and labels switched on; a larger organization usually needs the schedule mapped system by system.

Related reading

• Data Governance Policy: What to Include (with a Free Template)
• IT Policies and Procedures: The 10 Every Company Needs
• HIPAA Compliance Checklist for Small Practices and Health-Tech Vendors
• Data governance services

Frequently asked questions

What are the four data classification levels?

Public (approved for anyone), internal (for staff, low harm if leaked), confidential (business-sensitive, access by role) and restricted (regulated or highly sensitive, access by named individuals with strong controls). Regulations such as HIPAA, PCI DSS and state privacy laws define much of what belongs in the restricted level. Small companies sometimes merge internal and confidential into three levels.

How do I write a data retention policy?

Inventory your record categories, find the legal or regulatory floor for each, add any business need, and set a period that runs from a defined trigger such as contract end or employee departure. Define the disposal method, the legal hold rule and how backups are handled. Put it all in a schedule table with an owner per row, and have counsel confirm the regulated rows.

How long should a company keep data?

As long as a law, contract or real business need requires, and no longer. There is no single answer: financial, employment, medical and contract records each have their own drivers, and they differ by state and industry. The retention schedule records the period and its basis per category, and the risk of holding data argues for the shortest period that satisfies the floor.

What is the difference between data classification and data retention?

Classification decides how sensitive a piece of data is and therefore how it must be protected while you have it. Retention decides how long you keep it and how you dispose of it. They are separate policies that reference each other: the classification level often sets the disposal method, and the retention schedule often names the classification of each record category.

Do we need a tool to classify data?

Not to start. A written policy, a one-page handling matrix and labels applied by the people who create documents cover most organizations. Tools such as Microsoft Purview sensitivity labels, data loss prevention rules and cloud data scanners add automatic labeling, enforcement and discovery of sensitive data in places it should not be, which matters once you have more data than people can label by hand.