Handling data carefully

Not all data is equal. Treating everything the same either slows the business down or leaves sensitive information exposed. The goal is to match how you handle data to how sensitive it is.

Know your levels

Most organisations sort data into a few levels, for example:

• Public — fine to share anywhere (a published blog post).
• Internal — for staff, not for outsiders (a team roadmap).
• Confidential — limited to those who need it (contracts, salaries).
• Restricted — the most sensitive (customer records, health or payment data).

When you are unsure, treat data as more sensitive, not less.

Collect less, keep it less long

The safest data is the data you never collected. Only gather what you need for the task, and delete it when it is no longer needed. Old data you forgot about is still data an attacker can steal.

Store and send it the right way

• Keep sensitive files in approved systems, not on your desktop or a personal drive.
• Share by granting access inside an approved tool rather than emailing copies around.
• Double-check the recipient before you send. Autocomplete picks the wrong person more often than you think.

Watch where data travels

Pasting customer data into a random website or an unapproved AI tool sends it to someone else's servers. Use only tools your organisation has approved for that kind of data.

Quick rules

1. Classify first, then choose how to handle it.
2. Collect the minimum; delete what you no longer need.
3. Check the recipient twice before sending.