History

Purpose

This Policy makes sure that Tidewell IT protects information in proportion to its sensitivity, keeps it only as long as there is a reason to, and removes it safely afterwards.

Scope

This Policy covers all information that Tidewell IT creates, receives, or stores, on paper or in systems, including customer data that we hold on a customer's behalf, and everyone who handles it.

Policy statements

Classification levels

1. Information is classified as Public, Internal, Confidential, or Restricted.
2. Public information may be shared freely. Internal information is for staff and trusted partners. Confidential information is for named groups. Restricted information is for named people only, such as credentials, keys, and special-category data.
3. The owner of the information chooses the level. When in doubt, the higher level applies.

Labelling

1. Documents and storage locations carry their level. Customer data takes the level that the customer's agreement sets, and Confidential at least.
2. Files and messages that carry no label are treated as Internal until the owner says otherwise.

Handling rules

1. Confidential and Restricted information is transferred only in encrypted form and is shared only with people who need it.
2. Restricted information is not stored on laptops or sent by email. It stays in the approved systems.
3. Printed Confidential information is collected at once and is destroyed after use, in the locked shredding bins.
4. Confidential and Restricted information is not discussed in public places and is not put in public cloud storage.

Retention schedule

1. Each record type is kept for the period in the table below and is not kept longer without a reason that is written down.

Secure disposal

1. Storage media are wiped to a standard that fits their level before reuse, and are physically destroyed when they cannot be wiped.
2. The Service Desk records the disposal of each device and medium, and keeps the certificate of any destruction that a supplier performs.

Deletion

1. Information is deleted when its period ends. Deletion includes copies, exports, and test data derived from it.
2. A legal hold, announced by the Data Protection Officer, pauses deletion for the records concerned.
3. The deletion of customer data is confirmed to the customer in writing when the contract has ended.

Roles and responsibilities

The Data Protection Officer owns this Policy and the retention schedule. Information owners classify their information. The Service Desk Lead runs disposal and deletion. The HR Lead applies the schedule to HR records. The ISMS Manager checks that the rules are followed.

Exceptions

An exception needs a written request to the Data Protection Officer that states the reason, the risk, and an end date. No exception can keep personal data longer than the law allows.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. Internal audits sample records for correct labelling and timely deletion.

Related documents

• Information Security Policy
• Personal Data Protection Policy
• Cryptography Policy
• Data Subject Request Handling Procedure
• Acceptable Use Policy

Review

The Data Protection Officer reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.