Data classification and handling rules for agency records

Reference article · 5 min read

Most security decisions rest on a prior question: how sensitive is this record, and what happens if it is exposed, altered, or lost. A classification scheme answers it once, in writing, so staff do not have to decide privately every time they attach a file to an email, and so the agency can tell a vendor exactly what protection its system must provide. Classification sits underneath access control, encryption, retention, breach response, and most of the security language in a technology contract.

Schemes usually fail for the same reason: they are too elaborate. A seven level taxonomy with a decision tree gets drafted, approved, posted, and ignored. What works is a small number of levels, examples drawn from records the agency actually holds, and handling rules concrete enough that a caseworker or a records clerk can follow them without calling the security team.

Keep the scheme to three or four levels

Public. Records that are presumptively releasable and often already published: agendas, adopted budgets, permit data, contract awards.
Internal. Not sensitive, but not intended for publication: drafts, internal procedures, routine correspondence, most project files.
Confidential. Records protected by statute or regulation, or whose disclosure would harm individuals or operations: personally identifiable information, health and eligibility data, student records, personnel files.
Restricted. A small top tier for records governed by a specific external mandate with named controls, such as criminal justice information or federal tax information.

Three levels are enough for many agencies. If you fold Restricted into Confidential, write the mandate-specific rules down anyway; those rules are not negotiable and staff need them in readable form.

Map the levels to the records the agency holds

Criminal justice information. Data accessed through state and FBI systems carries FBI CJIS Security Policy obligations covering personnel screening, training, advanced authentication, physical protection, and audit. Treat it as restricted.
Health and eligibility records. HIPAA protected health information, Medicaid eligibility data, behavioral health records, and substance use disorder treatment records, which carry their own stricter federal confidentiality rules. Confidential at minimum.
Student records. Education records covered by FERPA, plus state student data privacy statutes that constrain what a vendor may do with student information.
Personnel and payroll files. Social security numbers, benefits elections, medical certifications, background results, and investigation files.
Presumptively public records. Most of what a general government agency produces. Public or internal.
Security-sensitive operational records. Network diagrams, control system configurations, facility drawings, vulnerability assessments. Many states exempt these from disclosure, but exemptions are specific and vary, so confirm the wording with counsel.

Classification never overrides public records law. A confidential label is a handling instruction, not a disclosure exemption; the records officer still evaluates each request on its statutory merits.

Attach handling rules to each level

Answer the same six questions for every level, in one table staff can print.

Storage. Name the approved systems for each level, and say plainly where confidential data may not go: personal devices, unapproved cloud accounts, unmanaged shared folders.
Sharing. Internal sharing on a role and need to know basis. Share confidential or restricted data outside the agency only under a data sharing agreement, memorandum of understanding, or contract clause that names the data and the controls.
Email. This is the most common failure point. Set a rule that confidential content is not sent in plain email, and give staff the alternative you actually operate, whether that is a secure messaging option or a link to a controlled location instead of an attachment.
Encryption. Encrypt in transit everywhere, and at rest for confidential and above, including laptops and removable media. Say who holds the keys.
Retention. Classification is not retention. Your state records retention schedule governs how long a record is kept; classification governs how it is protected while you keep it. Litigation holds override scheduled destruction.
Disposal. Cross cut shredding for paper, media sanitization following recognized guidance for drives and devices, documented destruction for anything a vendor holds, and a cloud deletion process that accounts for backups and copies.

Add three rules that prevent most disputes: unclassified data defaults to internal, not public; extracts, reports, and test data inherit the classification of their source; and combining datasets can raise the level even when each source is lower.

What to ask vendors and require in the contract

Before selection, ask which levels the system will hold and what controls the vendor applies at each, where data is stored and processed, which staff can access it and under what screening, how encryption and key management work, which subcontractors touch the data, and how quickly the vendor notifies the agency of a suspected breach.

In the contract, include a data exhibit listing the actual data elements and their classification, agency ownership of the data, flow down of the same obligations to subcontractors, assessment rights supported by independent control reports, a prohibition on using agency data for any purpose beyond the contract including model training, and a defined return and deletion process at termination.

How to start

List your systems and name a business owner for each, not only an IT owner.
Assign each system the single highest level of data it holds.
Write the one page handling table, and remove anything staff cannot actually do today.
Pilot it with one department, fix what confuses people, then adopt it.
Add a classification question to procurement intake so every new system arrives labeled.

Review it annually. HQT works with state and local agencies on data governance and security architecture, including the classification requirements that flow into system design and vendor contracts.

Frequently asked questions

How many data classification levels should a government agency use?

Three or four levels are enough for most state and local agencies: public, internal, confidential, and optionally a restricted tier for data governed by a specific external mandate such as criminal justice information or federal tax information. More levels look thorough but slow staff down and produce inconsistent labeling. The test of a scheme is whether a program employee can place a record correctly without asking anyone.

Does labeling a record confidential keep it out of a public records request?

No. Internal classification is a handling instruction for staff, not a legal exemption from disclosure. The agency's records officer still evaluates each request against the state public records statute and its exemptions, and a record may be releasable even if it is stored under tight internal controls. Coordinate the classification scheme with the records officer so labels do not create false expectations.

What is the difference between data classification and records retention?

Classification says how strongly a record must be protected while the agency holds it. Retention says how long the agency must keep it and when it must be destroyed, and is governed by the state records retention schedule. The two should be aligned in one policy but kept as separate decisions, and a litigation hold suspends scheduled destruction regardless of classification.

How do we tell a vendor what protection our data requires?

Put the classification into the solicitation and the contract rather than describing it in a meeting. A short data exhibit that lists the actual data elements, the classification level assigned to each, and the specific mandates that apply gives the vendor an unambiguous requirement to price and build against. It also gives the agency a basis to reject a system that cannot meet the controls at that level.

Who decides the classification of a system or dataset?

The program business owner who is accountable for the records decides, with advice from IT security, the records officer, and counsel. IT can enforce controls but usually does not know the statutory basis for a given record. Name an owner for every system in the inventory so classification disputes have a clear decision maker.