Securing company data
Every business deals with different types of business information. This can be customer information, financial administration, quotations, or personnel data. But also data about your production process or suppliers. It is often confidential information that may not be viewed by others due to laws and regulations, or for economic reasons. You can divide this information into different categories. Below we explain which classifications exist for company data.
Information is a raw material for running business operations. That is why it is important that you think about the confidentiality, availability, and reliability of the information. The dangers are that when confidential information leaks, it is no longer reliable and/or unavailable. This can have consequences for your business operations.
Types of classifications of information
There are different types of classifications of information. Each company can use its own classification system. From a safety point of view, classifications are distinguished on the basis of the effect of a data leak. Typically, the following classifications are distinguished:
- Secret information: sometimes information must be classified as 'secret'. This is the case with information where a company must comply with legal requirements and where a leak of this information could cause serious damage to the company.
- Confidential information: when the leak of this information leads to negative consequences for the company or when information can be related to a person.
- Internal information: when information is required for internal business operations. A leak does not lead to negative consequences.
- Public information: when information may be shared with the outside world.
The classification is always done by the owner of the information. The owner is responsible for the production, processing, use, and security of the information.
Customer and personal details
A specific form of company information is customer and personal data, their personal details. As an entrepreneur, you collect names, zip codes, dates of birth, telephone numbers, and email addresses of people and customers. Bank and credit card details are also often part of this list. How a company should deal with customer and personal details is laid down in the General Data Protection Regulation (GDPR). You can find the full text here. How you handle such informataion is not only a legal issue, but also a trust issue. Apart from any fines from the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP), the reliability of your company gets damaged if your customer and personal data is stolen or published on the internet.
Tips for handling customer and personal data
The level of classification determines the degree to which the information needs to be secured. Appropriate measures can be taken per level. The measures for secret information are determined by the specific legal requirements. Below are the measures you can take regarding confidential information. You can take the same measures for internal information, depending on the level of security required.
- Have employees give documents with confidential information a recognisable label, for example by putting the term 'confidential' on every page.
- Get permission from the owner of the information if their confidential information is to be shared with others.
- Make it possible for employees to send and store confidential information digitally. This includes encryption of email and the encrypted storage of information.
- Make employees aware that confidential information should not be automatically forwarded to non-personal email addresses or to external addresses unless authorised by the information owner.
Information can be in different stages:
- information in use
- information in motion (transit)
- information at rest
Encrypting information helps protect the availability, integrity, and confidentiality of information at all these stages.