GRCLibrary.ai

Standard

Data Classification and Handling Standard

To ensure that information is handled consistently according to its sensitivity, regulatory obligations, and business impact, while supporting confidentiality, integrity, and availability. Aligns with ISO/IEC 27002:2022 §§5.12 to 5.15, COBIT 2019 DSS05, CSA CCM v4.1 DSP-04, GDPR Article 32, ISO/IEC 27701:2025 (data retention and deletion; section numbering changed in 2025 standalone revision), and the applicable BASC International Security Standard (6.0.2 or 6.0.3).

Type
Standard
Version
1.9.2
Date
2026-10-27
Owner
Chief Information Security Officer
Approving authority
Governance Library Maintainer
Classification
Public
Confidentiality
Public
Category
Information Security
Review frequency
Annual and upon material threat, framework, or regulatory change
Licence
CC BY-SA 4.0

Read the full text on GitHub (opens in a new tab)

Outline

  • 1. Purpose
  • 2. Scope
  • 3. Governance and accountability
  • 4. Data classification levels
  • 5. Classification and labelling
  • 6. Handling requirements
  • 7. AI data classification and handling
  • 8. Retention and destruction
  • 9. Encryption requirements
  • 10. Sector-programme data handling overlays
  • 11. Monitoring and compliance
  • 12. Framework alignment

Frameworks it maps to

Related documents