Last Updated: August 15, 2026
Policy Owner: Chief Information Security Officer
1. Purpose & Scope
This policy establishes guidelines for protecting sensitive data and customer information at NexTech Corp. It applies to all employees, contractors, and third-party vendors with access to company systems.
2. Data Classification
All data must be classified into one of four categories:
Public - Data intended for public distribution (marketing materials, press releases)
Internal - General business information not meant for external sharing (meeting notes, project plans)
Confidential - Sensitive business data (financial reports, strategic plans, employee records)
Restricted - Highly sensitive data requiring strictest controls:
- Customer personally identifiable information (PII): names, addresses, email addresses, phone numbers
- Payment card information (PCI data): credit card numbers, CVV codes, expiration dates
- Protected health information (PHI): medical records, insurance information
- Authentication credentials: passwords, API keys, access tokens
- Social Security numbers, passport numbers, driver's license numbers
- Biometric data, financial account numbers, tax identification numbers
3. Handling Restricted Data
Employees must follow these requirements when working with restricted data:
Storage
- Store in encrypted databases or secure file systems only
- Never store in plain text files, spreadsheets, or email
- Never store passwords in code repositories or configuration files
- Use approved password managers (1Password, LastPass) for credential storage
Transmission
- Encrypt all data in transit using TLS 1.2 or higher
- Never send restricted data via unencrypted email
- Use secure file transfer methods (SFTP, encrypted cloud storage links)
- Verify recipient identity before transmitting sensitive data
Access Control
- Access granted on need-to-know basis only
- Multi-factor authentication (MFA) required for all systems containing restricted data
- Review and revoke access quarterly
- Log all access to restricted data for audit purposes
4. Prohibited Actions
• Sharing customer credit card numbers via email, Slack, or any messaging platform
• Storing real SSNs, passport numbers, or driver's license numbers in development/test databases
• Using production data in non-production environments without anonymization
• Taking screenshots of systems displaying PII/PHI/PCI data
• Copying restricted data to personal devices or cloud storage (Dropbox, Google Drive)
• Sharing passwords or API keys in code commits, wiki pages, or documentation
5. Data Minimization
Collect and retain only the minimum data necessary for business purposes:
- Do not request Social Security numbers unless legally required
- Avoid storing full credit card numbers—use tokenization
- Delete customer data upon account closure or per retention policy
- Anonymize or pseudonymize data when possible for analytics
6. Development & Testing
When building or testing systems that handle restricted data:
- Use synthetic or anonymized data in development and staging environments
- Never copy production databases to local machines
- Mask or redact sensitive fields (SSN → ***-**-1234, card → ****-4892)
- Run security scans to detect hardcoded credentials or exposed secrets
- Implement data loss prevention (DLP) tools to flag sensitive data in code
7. Third-Party Vendors
Before sharing restricted data with vendors:
- Ensure vendor has signed Data Processing Agreement (DPA)
- Verify vendor SOC 2 Type II compliance or equivalent
- Conduct security assessment and review vendor's data protection practices
- Limit data shared to minimum required for service delivery
8. Incident Response
If you suspect unauthorized access to restricted data:
- Immediately notify IT Security (security@nextech.example)
- Do not delete logs or evidence
- Document what happened, what data was involved, and when you noticed
- Cooperate fully with the incident response team
9. Training & Awareness
All employees must:
- Complete annual data protection training
- Acknowledge this policy in the HR system
- Report policy violations to their manager or Compliance team
10. Enforcement
Violations of this policy may result in disciplinary action, up to and including termination of employment, and may expose individuals to civil or criminal liability.
Questions? Contact the Compliance team at compliance@nextech.example
Acknowledgment: All employees must acknowledge receipt and understanding of this policy in the HR portal by September 30, 2026.