Compliance guide
Data Security Policy Template
A data security policy sets out how your business protects the information it holds, by classifying data and applying the right handling rules to each level. Use the free template, classification model and sample wording below, or have a tailored version prepared for you.
Last updated
What a data security policy does
A data security policy sets out how your business protects the information it holds, across its whole life: how data is classified, stored, shared, retained and disposed of. At its heart is a simple idea: not all data is equally sensitive, so it shouldn't all be treated the same way. That's what data classification is for.
It's one of the most commonly requested supporting documents under a cyber security policy, because customers want to know their data will be handled appropriately once it's in your hands.
A simple data classification model
Most small and medium businesses do well with three or four levels. Adapt the labels and handling rules to your business:
| Level | Examples | Handling |
|---|---|---|
| Public | Marketing, published content | No restrictions |
| Internal | Internal docs, plans | Staff only; don't share externally |
| Confidential | Customer data, contracts | Access on need-to-know; encrypt in transit |
| Restricted | Payment, health, credentials | Strict access, encryption, logging |
What to include: data security policy template structure
Adapt this outline to your business:
- Purpose and scope, why the policy exists and what data and systems it covers.
- Data classification, your levels (e.g. Public, Internal, Confidential, Restricted) and what falls into each.
- Handling rules, how each level must be stored, shared, transmitted and disposed of.
- Access, who can access which data, on a need-to-know basis (links to your access control policy).
- Encryption, when data must be encrypted in transit and at rest.
- Storage and backups, where data lives and how it's backed up.
- Retention and disposal, how long data is kept and how it's securely destroyed.
- Third parties, expectations for vendors who store or process your data.
- Breach handling, links to your incident response process.
- Responsibilities and review, who owns the policy and how often it's reviewed.
Download the editable data security policy template
Enter your email and the data security & classification policy template (Word and PDF) is yours, with the classification model ready to adapt.
How to put it into practice
A classification scheme only helps if people can actually apply it.
- 1
Agree your levels
Pick three or four classification levels and define them in plain language.
- 2
Map your data
Identify the main types of data you hold and assign each a level.
- 3
Set handling rules
For each level, set clear rules for storage, sharing, encryption and disposal.
- 4
Label and train
Show people how to label documents and handle each level day to day.
- 5
Review
Revisit the policy and your data map at least annually.
Prefer your data security policy done for you?
Tell us what kind of data you hold and we'll prepare a tailored data security and classification policy with handling rules matched to your business.
Requests for the data security policy are reviewed and prepared manually, we'll follow up by email.