A Data Management policy outlines how an organization collects, stores, handles and disposes of data. This policy is an essential requirement of many compliance frameworks such as GDPR, ISO 27001, SOC 2 and. It is often brought up during vendor security reviews (should you decide to work with larger enterprises with strict security requirements which they work with). Regardless of the reasoning, a Data Management Policy is essential and beneficial to any organization, and this blog post will delve into the essential components, share Data Management policy examples and explain how you can implement it quickly (and for free) using our Policy Manager.

Components of a Data Management Policy

1. Data Classification

Data classification is the process of categorizing data based on its level of sensitivity and the impact that the unauthorized disclosure of said data would have on your organization. There are typically 3 levels which are consistent across organizations. The following is an excerpt from our policy template which can be used to satisfy your policy requirements.

• Confidential Data
  • Description: Data that, if disclosed without authorization, could result in significant harm to the organization, its employees, customers, or partners. 
  • Examples: Personal Identifiable Information (PII), financial records, intellectual property, legal documents, health records. 
  • Handling Requirements: 
    • Must be encrypted during storage and transmission. 
    • Access is limited to authorized personnel only. 
    • Must not be shared outside the organization without proper authorization. 
    • Must be stored in secure locations with access controls. 
• Restircted Data
  • Description: Data that is less sensitive than confidential data but still requires protection due to its importance to the organization. 
  • Examples: Internal communications, non-public project documentation, internal memos. 
  • Handling Requirements: 
    • Should be protected with access controls. 
    • Must be encrypted during transmission. 
    • Access is restricted to relevant departments or individuals. 
    • May be shared internally as needed, but not outside the organization without proper authorization. 
• Public Data
  • Description: Data that is intended for public disclosure and poses minimal risk if accessed by unauthorized individuals. 
  • Examples: Marketing materials, press releases, publicly available financial reports. 
  • Handling Requirements: 
    • No specific access controls are required. 
    • May be freely shared and distributed both internally and externally. 

How To Implement It

Once you define your Data Classification standards, it’s important to start educating your employees on it and labelling data where applicable. For example, say you have a Cloud environment to host your application (e.g. Google Cloud Platform, Azure, AWS); you can create tags (such as the following) to tag resources to get an idea of the types of data classification it handles. The following is an example of a CLI command for GCP for how such a tag structure can look for GCP resources:

$ gcloud compute instances add-labels INSTANCE_NAME --labels=Owner="John Smith",DataType="Confidential",Environment="Production"

2. Data Retention

Data retention involves setting policies for how long different types of data should be stored before being deleted or archived. This ensures that data is kept only as long as it is helpful or required by law. If you do business in Europe or specific states, you may be subject to additional requirements (e.g. Right to Forget for GDPR) which should be used to determine your data retention schedule. Additionally, this section in your policy should address how often reviews are done to review the policy data – most regulators/auditors will look for mention of annual re-evaluations/updates.

3. Data Disposal

It is equally important to have a clear process for Data Disposal in addition to retention and classification. Data Disposal involves securely getting rid of data and devices. For digital data, this means wiping storage devices or using data destruction software. For physical data, like paper documents, this involves shredding. Devices that are no longer in use and contain organizational data should be wiped of all data before being disposed of. For highly sensitive data, a destruction certificate should be obtained from the disposal vendor or responsible party to confirm that the data has been irretrievably destroyed.

4. Data Retention Schedule

A data retention schedule should be a table within your data management policy (typically included in the appendix) that lists the types of data you hold and the retention period. While this will most likely be easier for service-based companies, this may prove trickier for SaaS companies as there may be third-party dependencies (e.g. third-party APIs which process your user’s data) which may have their own retention schedules. It’s crucial to ask them about their policies and list them within your Data Retention schedule; the following is an example of a Data Retention Schedule from our template.

System	Data Description	Retention Period
Customer Sales (SalesForce, Mailchimp)	Opportunity and Sales Data	Indefinite
Legal Agreements (DocuSign)	Legal agreements for internal and third parties that include basic PII such as full name and email address.	Indefinite
Communication platforms (Slack/Teams)	Messages exchanged internally and externally for collaboration and productivity which may include PII depending on the message context.	Indefinite
Marketing Material (Canva)	Public marketing material and other designs	Indefinite
Customer Data (AWS)	Platform data hosted in AWS RDS databases.	7 days after contract termination

Creating a Data Management Policy using WatchDog Security’s Free Policy Manager

Using a free subscription to the WatchDog Security platform, you can leverage our policy manager to create and disseminate policies (such as a Data Management Policy) to your team members and have a centralized hub to manage everything. To get started, sign up here. Once you sign up, navigate to Policy Manager and click Create New Policy.

Select the Create Using Template option to pre-populate it with various information to help speed up policy development.

Edit the highlighted parts of the policy with your organization-accepted parameters and click Publish Policy. Now all the users added via Employee Management will receive the policy to accept in their dashboard.

Additional Resources

• Data Management Policy Template for CIS Control 3 (CIS Center for Internet Security)