Data Classifications


KS Data Classifications


KS Corporate/KS IT/KS InfoSec

Issue Date

June 2019



This document contains the mappings to HMG Classifications scheme, OFFICIAL, SECERT and TOP SECRET.

Because all HMG information falls in to the OFFICAL classification by default if it has not been given a higher classification, this means that it can contain a range of sensitive or public material. As such OFFICAL information should by handled in the same way as KS’s INTERNAL classification. Information marked as OFFICAL and caveated SENSITIVE should be handled in the same way as KS’s SENSTIVE classification

KS Systems are not secured to the correct standard to process SECERT or TOP SECERT information.

Failure to comply with this procedure could result in action in line with KS’s disciplinary procedure.

Annex A – Classifications






Information that is intended for public distribution and requires no specific security handling.

Information relating to routine business operations and services, where it is prudent to maintain a need-to-know approach. This covers the majority of KS-generated information.

Information that has a clear elevated sensitivity due to its legal, contractual or business value.

Impact if compromised

Minimal or no risk to our operations, service delivery or reputation.


No discomfort or embarrassment to individuals.


No breach of statutory obligations.

Minor reputational risk


Technical breach of duty of confidence


Possible breach of statutory obligation


Short-term discomfort or embarrassment to an individual


Commercial disadvantage or loss


Short-term disruption to our operations and services

Serious reputational risk


Danger to personal safety


Major breach of statutory obligation


Prolonged distress, discomfort or embarrassment to an individual.


Distress, discomfort or embarrassment to a group of individuals


Serious commercial disadvantage or loss, including financial or legal penalties


Long-term disruption to our operations and services


Marketing material


Published information on public websites


Vacancy details


Anonymized statistical information


Any information already disclosed under the Freedom of Information Act 200.

Internal correspondence


Policies and procedures


Working documents


Personal data on staff and clients but not meeting the GDPR definition for Special Category Data

Staff passwords for KS devices and systems


Administrator passwords for KS devices and systems


Client usernames and passwords


Client data


Information relating to ongoing commercial or research projects where disclosure could jeopardize the project


Financial information defined as commercial-in-confidence


Special Category Data as defined in foot note [1]


Information covered by The Official Secrets Act 1989.

Annex B – Handling requirements






Intended for public distribution, although embargoes may apply prior to publication

Available to any authenticated KS member (.e.g with Login Access)

Available only to specified authenticated KS members, with login access and additional authorization.


Internal copies should be visibly marked ‘PUBLIC’

There is no requirement to visibly mark.

All copies should be visibly marked ‘SENSTIVE’


Reference the classification in the subject line and or text of email communications.


Primary copy on KS Network Drive or KS Systems

Primary copy on KS Systems


When possible should be kept on KS Systems.


Store physical assets securely when not in use. Lock IT equipment when unattended



Data covered by the GDPR should remain as far as possible in the appropriate KS systems. Where downloaded or otherwise this should be done on KS drives (personal or shared).


Can keep on KS laptops, if encrypted/password protected, and taking care to avoid loss and theft.


KS SENSITIVE data should not be stored on personal devices.


Can email without encryption or password protection.


Can be sent in the standard mail.

The use of encryption or password protection should considered, but is not mandated. Extra consideration should be given to encryption of KS staff data, bank account details etc are being transferred in large numbers.


Can be sent in the standard mail, but for large data sets Royal Mail Signed for should be considered.

Not to be communicated externally expect in defined circumstances. E.g. pre-agreed data sharing, police investigation.


Authorized staff should email with encryption or use another mechanism


When discussing in public or by telephone, appropriate discretion should be exercised. Details of sensitive material should be kept to a minimum.


Should only be posted using Royal Main signed For or equivalent.


Intended for public distribution, although embargoes may apply prior to publication.

Can share for business purpose, maintaining a need-to-know approach.


Can share via KS network drives, OneDrive, SharePoint and on authenticated website.

Internal distribution should be according to a strict application of the need to know principle. Where there is a reason to share selected or general information from a SENSITIVE report more widely, originators should develop a version at INTERNAL or PUBLICE where possible.


Can be shared via KS network drives, OneDrive or SharePoint as long as access is appropriately restricted.


Particular care should be taken when sharing information with external partner or the public; for example, emails and letters should only be sent to named recipients at the known addresses where there is an agreed business need to share (which may be supported by a data sharing agreement)


No restrictions

Information is not freely available in the public domain should be destroyed in a way that makes reconstitution unlikely.

Information should be destroyed in a way that makes reconstitution difficult. For example, paper files should be shredded. Electronic devices should be wiped or destroyed according to IAS5 or equivalent.

Remote Access

Can be held on public website or authenticated systems.

Can be held on systems accessible via authenticated web service or VPN access.

Should only be held on systems requiring VPN access.

Off-site working

No restrictions

Physical assets should be protected in transit, not left unattended, and stored securely. Precautions should be taken to prevent overlooking or inadvertent access when working remotely or in public places.

Removal of physical assets should be confirmed with the asset owner. Physical assets should be protected in transit, not left unattended, and stored securely. Precautions should be taken to prevent overlooking or inadvertent access when working remotely or in public places.

[1] Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation; and  the commission or alleged commission by them of any criminal convictions or offence, or any proceedings for any offence committed or alleged to have been committed by them, the disposal of such proceedings or the sentence of any court in such proceedings.