Data Classification Policy: A Practical Guide for Canadian Businesses

A data classification policy is a short, enforceable document that sorts everything your business holds into a few sensitivity levels and attaches a handling rule to each one. For a Canadian small business, three levels (Public, Internal, Confidential), a named owner for each data set and one page of handling rules is enough to start. Without it, a client’s health card number and your lunch menu receive the same protection, which means one of them is protected wrongly. Most breaches become expensive because nobody knew where the sensitive data lived before the attacker found it.

TL;DR

• Use three levels for most small businesses: Public, Internal and Confidential. Add a fourth only if you hold data whose exposure would be severe, such as health or payment records.
• Classify by the harm that disclosure would cause, not by file type, and treat anything unclear as the higher level until someone decides otherwise.
• Every level needs rules for access, storage, sharing, retention and disposal. A level without rules is a label, not a control.
• Feed the results into a simple IT risk register, so spending on security follows the data that matters most.
• In Canada, the policy supports your duties under PIPEDA and, for health custodians in Ontario, PHIPA.

Table of Contents

• What a data classification policy does for a small business
• Classify by harm, not by file type
• Data classification levels with examples
• Handling rules for each level
• Canadian rules the policy has to support
• Information classification policy template: what to include
• How to build it in five steps
• From classification to an IT risk register
• Our perspective
• Getting help turning the policy into controls
• FAQ
• Sources

What a data classification policy does for a small business

A data classification policy is a roadmap for sorting data by sensitivity and related criteria so that the right protections are applied to the right information. TechTarget describes it as a way to reduce breach risk and allocate security resources effectively. That second benefit matters most for a business with a limited budget: you cannot encrypt, monitor and back up everything to the same standard, so you decide what earns the strongest controls.

The gap between large and small organizations is often written policy. In 2021, only 26% of Canadian businesses had written cyber security policies. A classification policy is one of the most useful documents to add to that small group, because every other control (access rights, backups, encryption, staff training) depends on knowing what is sensitive.

The policy answers five questions your team otherwise answers differently every day:

1. What kinds of information do we hold?
2. How sensitive is each kind?
3. Who owns it and who may see it?
4. Where may it be stored and how may it be shared?
5. How long do we keep it, and how do we destroy it?

Classify by harm, not by file type

The most common mistake is classifying by format: spreadsheets are internal, PDFs are public. A spreadsheet of client SINs and a PDF of a signed engagement letter are both confidential, whatever their extension. The Province of British Columbia’s Information Security Classification Standard takes the better approach: classification is driven by the probable harm of unauthorized disclosure, and both content and context are examined. The same list of names can be harmless in a published annual report and damaging inside a complaint file.

McGill’s enterprise data classification standard adds a second lens: consider the impact if confidentiality, integrity or availability is compromised. Availability is easy to forget. Your appointment schedule may not be secret, but if ransomware locks it for a week, the loss is real. When classifying, ask three questions for each data set:

• What happens if the wrong person reads it?
• What happens if someone alters it without us knowing?
• What happens if we cannot reach it for several days?

Data classification levels with examples

For most small businesses, three levels are enough: Public (marketing material and website content), Internal (plans, internal documents and routine email) and Confidential (customer personal information, financial and payment data, contracts, credentials and health information).

Larger Canadian institutions use more granular models, which are useful references if you operate in a regulated field:

• British Columbia uses four levels based on expected harm: Public, Protected A, Protected B and Protected C, corresponding to no harm, harm, serious harm and extremely grave harm.
• McGill uses three levels: Public, Protected and Regulated.
• The University of Toronto uses four levels: Level 1 Public, Level 2 non-public by default (internal), Level 3 sensitive personal or business information, and Level 4 highly sensitive information requiring substantially greater protection.

Here is how those ideas translate into a practical table for a Toronto-area small business:

Public examples such as press releases, public web pages, brochures, annual reports and employee business contact details come from McGill’s standard. Confidential examples such as contracts, privileged legal advice, security logs and network diagrams mirror the University of Toronto’s Level 3 list, which also puts non-public financial information and employee records at that tier. Adopt the fourth level only when a regulation or contract demands it. A dental clinic holding patient charts or a retailer processing card payments will likely need it; a design studio probably will not.

When you cannot decide

McGill’s rule is a good default: when classification is ambiguous, treat the information as Protected until it can be reclassified. Translated for a small firm, an unlabelled document is Confidential until its owner says otherwise. This keeps staff from guessing downward under deadline pressure.

Handling rules for each level

The classification only works if each level carries concrete rules. Handling should correspond to sensitivity: the most sensitive data requires strict access controls, encryption and specific training. A workable matrix looks like this:

Physical access counts as well. Locked cabinets, badge or key control and a record of who holds keys belong in the same matrix as passwords, and small business access control covers the practical side of securing premises where Confidential paper and equipment are kept.

Retention and disposal

The federal Office of the Privacy Commissioner expects organizations to keep personal information only as long as necessary for the purpose it was collected, to document retention and disposal schedules, and to dispose of it securely, for instance by cross-cut shredding paper and wiping electronic media so that information cannot be reconstructed. The Ashley Madison investigation takeaways make the same point: retention needs a demonstrable rationale, and the OPC contrasted justified retention with the indefinite keeping of inactive accounts as an example of bad practice.

For health records in Ontario, the Information and Privacy Commissioner says secure disposal means destruction such that reconstruction is not reasonably foreseeable. Note that this covers backups and retired laptops, not only live files. Retired drives are where classification policies most often fail quietly.

Canadian rules the policy has to support

Under PIPEDA, organizations must take reasonable steps to safeguard personal information, and reasonableness depends on the sensitivity of the information, foreseeable risks, potential harm and the cost of preventive measures. That is close to a description of classification itself: you cannot show proportionate safeguards without showing that you assessed sensitivity.

In Ontario, health information custodians must protect personal health information from theft, loss and unauthorized use or disclosure, and ensure records are stored, transferred and disposed of securely. If a clinic asks about HIPAA, note that it is a United States law. Canadian clinics answer to PHIPA and PIPEDA, and some Canadian providers also meet HIPAA-style controls because they serve American patients or partners. Either way, the classification policy is the evidence that you know where the regulated data sits. For a wider view, see our overview of Canadian data privacy laws businesses must know.

Payment data follows a different regime: PCI-DSS is an industry standard, not a statute, and it applies to anyone who stores, processes or transmits card data. In your policy, card numbers belong in the top tier, and the best handling rule is often not to store them at all.

Information classification policy template: what to include

Use this outline as a starting point. A policy for a small business should run two to four pages; if it is longer, nobody will read it.

1. Purpose and scope. Which data, systems, staff, contractors and locations the policy covers, including personal devices and cloud tools.
2. Roles. Who owns each data set, who approves exceptions and who reviews the policy. Saskatchewan’s information protection classification guide names typical participants: the information owner, senior management, privacy and security officers, cybersecurity staff and records-management personnel. In a ten-person firm, one person may hold several of these roles.
3. Classification levels. Definitions with two or three examples each, in plain language.
4. Classification method. The questions staff ask (harm if disclosed, altered or unavailable) and the default for unclear cases.
5. Handling rules. The matrix above, adapted to your tools.
6. Labelling. Where labels go: file names, document headers, Microsoft 365 sensitivity labels, folder structure.
7. Retention and disposal. Periods by record type and the destruction method.
8. Incident reporting. Whom to tell, and how fast, when Confidential data is lost or exposed.
9. Training and acknowledgement. Every employee signs, and new hires read it in the first week.
10. Review. At least annually, and after any breach, merger or new system.

How to build it in five steps

1. Inventory what you hold

Saskatchewan’s guide begins classification with an inventory of the information in each application, system or service, followed by a check on whether personal information is present. Start with a spreadsheet: system, what it contains, who uses it, where it is stored, whether it holds personal information. Include the unglamorous places: shared mailboxes, scanned documents on a copier, exported reports on desktops, and your accounting and CRM platforms.

2. Assign owners

Each data set needs one accountable person, usually the manager who creates or depends on it, not the IT provider. IT implements the controls; the owner decides the level.

3. Classify and label

Work through the inventory with the harm questions. Resist creating exceptions. Label in the places staff already look, so classification becomes part of saving a file, not an extra task.

4. Apply the controls

Match each level to technical settings: permissions, encryption, multi-factor authentication, data loss prevention rules, backup scope. Our guides on securing IT infrastructure for a small business and the network security checklist for small business cover the surrounding controls, and endpoint protection protects the devices where Confidential data is opened.

5. Train and review

A policy that lives in a folder does not change behaviour. Pair it with short, measurable lessons; our list of security awareness training topics is a good source. Review annually and after every incident.

From classification to an IT risk register

Classification tells you what matters; a risk register tells you what could go wrong with it and what you will do about it. The Canadian Centre for Cyber Security suggests small and medium organizations assess potential injury to the confidentiality, integrity and availability of their systems and assets on a Very Low to High scale, then use that assessment to guide security investment. The same guidance recommends naming a leader responsible for IT security and considering 4 to 7% of the IT budget for cybersecurity. For planning that spending, see our IT security budget planning guide.

A proportionate register for a small business can fit on one page. Each row links a risk to a classified data set:

Score likelihood and impact on the same Very Low to High scale, rank the rows, and fund the top ones first. Notice that the lowest-value row is the Public one. Classification lets you stop worrying equally about everything.

Our perspective

We see the same pattern across small organizations. The firm has a firewall, antivirus and a backup, yet nobody can say which folder holds the client identification documents, who can open it, or whether the backup of it is encrypted. Controls bought without classification are controls spread evenly over data of unequal value.

Our approach is cybersecurity-first, so we begin with the inventory before recommending tools. In practice that means identifying the three or four data sets whose loss would hurt most, locking those down properly (access, encryption, monitoring, tested recovery) and keeping the rest simple. For regulated clients such as healthcare and finance, the classification record also becomes the document that shows an auditor or a privacy regulator that safeguards were chosen deliberately. Accounting practices in particular should read our CPA firm cybersecurity policy guide, where classification sits alongside the other policies a firm needs.

If you have not yet written the policy, do it this month. Attackers do not wait for the annual review, and the cost of discovering your most sensitive data only after it has been exposed is far higher than the cost of a two-page document. For the wider threat picture, see why cybersecurity is a business priority and the types of business cybersecurity threats.

— 247techify Team

Getting help turning the policy into controls

Writing the policy is the easy half; enforcing it across Microsoft 365, endpoints, backups and networks is where small teams stall. Our managed IT services in Canada cover 24/7 support, threat monitoring, endpoint protection, Microsoft 365 management and backup and recovery, with business plans published at $1,099 to $2,499 CAD per month. For a single ad hoc question, such as setting up sensitivity labels, our pay-per-ticket support is $79 per ticket, listed on the pricing page. If you want a security review of where your Confidential data is exposed, start with our cybersecurity services.

FAQ

How many classification levels does a small business need?

Three is enough for most: Public, Internal and Confidential. Add a fourth, Restricted, only when a regulation or contract requires stronger handling for something like health records or card data. More levels than staff can remember produce mislabelled files, not better security.

Who is responsible for classifying data?

The business owner of each data set decides its level, with guidance from whoever handles privacy and security. IT applies the technical controls but should not decide sensitivity alone. In a very small firm, one person may fill several roles, provided the responsibilities are written down.

How often should the policy be reviewed?

Review it at least once a year, and again after a breach, a new system rollout, a merger or a change in law. Reclassify data when its context changes. A client list that was Internal can become Confidential once it is combined with financial details.

Does a classification policy satisfy PIPEDA?

No single document does, but it is strong evidence of reasonable safeguards. PIPEDA expects safeguards proportionate to the sensitivity of personal information, and classification is how you show you assessed that sensitivity. You still need consent practices, access request handling and breach reporting procedures.

What should I do with data I cannot classify?

Treat it as the higher level until its owner decides. That conservative default prevents sensitive material from being handled as Internal simply because nobody had time to label it.

Sources

• How to write a data classification policy, with template (TechTarget)
• Get Cyber Safe Guide for Small Businesses
• Information Security Classification Standard (Province of British Columbia)
• Data classification, made simple (intrasec)
• Standard on Enterprise Data Classification (McGill University)
• Data Classification Standard (University of Toronto)
• PIPEDA Self-Assessment Tool (Office of the Privacy Commissioner of Canada)
• Ashley Madison Investigation: Takeaways for all organizations (OPC)
• Securing Personal Information: A Self-Assessment Tool (OPC)
• PHIPA Frequently Asked Questions (Information and Privacy Commissioner of Ontario)
• A Guide for Information Protection Classification (Government of Saskatchewan)
• Baseline cyber security controls for small and medium organizations (Canadian Centre for Cyber Security)
• Small Business Access Control guide

Recommended

• Canadian Data Privacy Laws Businesses Must Know
• Cut Risk: Measurable Security Awareness Topics for Canadian Firms
• Application Whitelisting Policy: How to Write One That Holds
• This Quarter, Prevent Data Breaches in Canada With Layered Security