Skip to main content

Last updated by: PeterSushi, Last updated on: 29/06/2025

Update DLP & Data Classification Policies

Redback Operations Policy

Document Creation: 8 April, 2024. Last Edited: 15 May, 2025. Authors: Jamison Begley.

Document Updated By: Peter Huang

Purpose​

The purpose of this DLP & Data Classification Policy is to ensure that all possible protective measures are followed to ensure the integrity, confidentiality, and overall safety of Redback Operations’ assets and sensitive information. These measures should be regularly audited and checked for compliance to guarantee the company’s digital safety.

Data Classification​

To ensure the safety and integrity of our data, we must deploy a range of carefully illustrated Data Classification Policies, which must be adhered to, to protect sensitive information in the event of a data breach.

Data Classification Policies are designed to categorize and prioritize data based on factors such as its sensitivity, importance, and its impact on the business. This categorization influences the appropriate storage, encryption, and access requirements for different types of data, ensuring the protection of sensitive information. These Data Classification policies work in tandem with our DLP (Data Loss Prevention) policies, which are designed to identify, monitor, and mitigate risks to safeguard our data.

Sensitivity​

Sensitivity refers to the level of confidentiality or privacy associated with the data, indicating how critical it is to protect against unauthorized access or disclosure. Data that may be considered sensitive includes personally identifiable information, such as financial information, records, customer information (names, addresses, etc.). Sensitive information like this must be classified as somewhat restricted, where only those required to access it can do so. This can be managed through the DLP policy of Access Controls.

Alternatively, non-sensitive data refers to data that does not pose any significant risks or impacts if unauthorized parties access it. Examples of non-sensitive data include public business information, such as publicized business trends, general contact information, or press releases. Additionally, non-identifiable data, such as anonymous customer feedback or statistical reports, can also be classified as non-sensitive.

Importance​

Importance refers to the significance of data to the business’ operations, strategic objectives, or regulatory compliance requirements. Important data includes customer databases, intellectual property, business continuity documents (for future projects/campaigns), and regulatory compliance documents. Furthermore, business contingency and emergency response plans must be categorized with high importance, ensuring documentation is accessible in emergencies.

Data that is not directly relevant or critical to the business, such as outdated data, non-strategic business information, and general employee training information, may be classified as non-important.

Business Impact​

Business Impact refers to the potential consequences from the loss, compromise, or unauthorized access of data, including financial losses, reputational damage, and operational disruptions. Data with high business impact includes critical information like customer/employee personal information, financial forecasts, and business continuity plans.

Data with a low business impact if compromised may include outdated marketing materials, redundant data, or non-sensitive employee feedback. Despite this, such data should still be adequately protected, as its relevance may change over time.

Data Classification Summary​

Based on the categories of Sensitivity, Importance, and Business Impact, data can be classified into four levels:

  • Public: Data intended for public disclosure. Encryption is not required, but integrity practices should still be applied.
  • Internal Use Only: Data intended for use within the organization. Basic encryption controls are recommended.
  • Confidential: Sensitive data that could cause harm if disclosed. Requires encryption in transit and at rest, using industry-standard algorithms.
  • Restricted: Highly sensitive data that could cause significant harm or non-compliance if disclosed. Strong encryption with strict access controls is mandatory.

DLP Policies​

To ensure data integrity and safety, DLP policies are required to proactively identify, monitor, and mitigate risks involving unauthorized access or data breaches. These policies work in tandem with our Data Classification policies, ensuring that data is protected based on its classification.

Access Controls​

Access controls must be established to ensure the protection of sensitive data. The least privilege principle must be applied, granting access rights only to those necessary to perform their job. Role-based access controls can be implemented for team-related work.

Watermarking Content​

Confidential data should be watermarked with “RedBack Operations.” This prevents theft and enables tracking of any potential breaches if branded content is found online.

Encryption​

All sensitive data within Redback Operations must undergo encryption while in storage and during transit. Only those with the correct access controls should be able to decrypt data.

Preventing Unauthorized Copies of Data​

To prevent unauthorized copying, access controls must be in place. Watermarks, screen-capture prevention, and clipboard control should be used to protect against data theft.

Content Inspection​

Automated content inspection should regularly monitor files and communications to detect unauthorized dissemination of sensitive data. Scans for keywords, patterns, and file types should be implemented to ensure data isn’t released without authorization.

Policy Enforcement​

Policy enforcement ensures that all DLP and Data Classification policies are followed. Regular audits and both automated and manual inspections should be conducted to assess compliance.

Conclusion​

By adhering to the DLP and Data Classification policies outlined in this document, the safety and integrity of Redback Operations’ data can be ensured. Regular audits should be conducted to review the effectiveness of these policies and adapt them to emerging technologies and potential risks.