Data Classification & Handling Policy

Lekhan Kala

Document Title: Data Classification & Handling Policy
Organization: LekhanKala.org
Effective Date: 3 August 2026
Review Cycle: Every Two Years
Approved By: Board of Directors

Data Classification & Handling Policy

1. Purpose

LekhanKala.org is committed to protecting the confidentiality, integrity, availability, and proper use of information during its entire lifecycle.

This policy delivers a standardized structure for identifying, classifying, storing, accessing, sharing, transmitting, retaining, and securely disposing of information based on its sensitivity, value, legal requirements, and business impact.

Proper data classification enhances information security, safeguards privacy, supports child safeguarding, reduces cybersecurity risks, and secures compliance with laws and recognized standards.

2. Policy Statement

LekhanKala shall classify all information it creates, collects, receives, processes, stores, transmits, or disposes of according to its sensitivity and handle it in accordance with this policy.

All individuals with access to organizational information are responsible for protecting it appropriately and must have a legitimate business, legal, educational, or operational need.

3. Scope

This policy applies to:

* Board Members
* Employees
* Volunteers
* Interns
* Consultants
* Contractors
* Researchers
* Trainers
* Partner organizations
* Service providers
* Temporary personnel

It applies to information stored in any format, including:
* Paper records
* Electronic files
* Email
* Cloud services
* Databases
* Mobile devices
* Portable storage devices
* Audio recordings
* Video recordings
* Photographs
* Printed publications
* Social media content
* Backup media

4. Objectives

This policy aims to:
* Protect confidential information.
* Prevent unauthorized disclosure.
* Ensure consistent handling of information.
* Support GDPR compliance.
* Support child safeguarding.
* Protect donor and partner information.
* Improve information security resilience.
* Decrease operational risks.
* Promote accountability.
* Ensure legal compliance.

5. Guiding Principles

LekhanKala shall manage information according to these principles:
* Confidentiality
* Integrity
* Availability
* Accountability
* Data limitation
* Need-to-know access
* Least privilege
* Privacy by Design
* Security by Default
* Transparency
* Lawfulness
* Risk-based protection

6. Information Classification Levels

LekhanKala uses four information classification levels.

Level 1 – Public
Definition
Information approved for public release.

Disclosure presents little or no risk to the organization.
Examples
* Website content
* Published reports
* Press releases
* News articles
* Public newsletters
* Job advertisements
* Public educational resources
* Published research
* Social media posts
* Event announcements

Handling Requirements
* May be shared publicly.
* No special restrictions.
* Maintain integrity.
* Verify correctness before publication.

Level 2 – Internal
Definition
Information intended for internal organizational use.
Unauthorized disclosure would have limited operational impact.
Examples
* Internal procedures
* Staff manuals
* Meeting agendas
* Training materials
* Internal planning documents
* Internal communications
* Operational calendars

Handling Requirements
* Accessible only to authorized staff.
* Do not publish externally without approval.
* Store securely.
* Share only where necessary.

Level 3 – Confidential
Definition
Sensitive information needing enhanced protection.
Unauthorized disclosure could cause legal, financial, reputational, or operational harm.
Examples
* Personnel records
* Volunteer records
* Donor information
* Financial records
* Contracts
* Partnership agreements
* Internal investigations
* Security reports
* Personal information
* Student records
* Membership information
* Grant proposals
* Audit reports

Handling Requirements

* Role-oriented access.
* Password-protected systems.
* Encryption during transmission where feasible.
* Secure cloud storage.
* No unauthorized copying.
* Secure disposal required.

Level 4 – Highly Confidential / Restricted
Definition
The highest level of organizational protection.
Unauthorized disclosure could seriously harm individuals or the organization.
Examples
* Child safeguarding records
* Criminal background checks
* Identity documents
* Passport copies
* Banking information
* Authentication credentials
* Encryption keys
* Security incident investigations
* Sensitive legal documents
* Whistleblower reports
* Medical information where lawfully processed
* Incident response records

Handling Requirements
* Strict “need-to-know” access.
* Multi-factor authentication if available.
* Encryption at rest and in transit where feasible.
* Limited copying.
* Detailed access logging where practical.
* Executive authorization for external disclosure.
* Secure destruction after retention period.

7. Data Ownership

Each dataset shall have a designated information owner responsible for:
* Correct classification.
* Access approval.
* Periodic review.
* Accuracy.
* Legal compliance.
* Secure disposal.

8. Access Control

Access shall be granted based upon:
* Job responsibilities
* Operational necessity
* Least privilege
* Need-to-know principle
* Approved authorization

Access shall be reviewed periodically.

Remove access for former staff, volunteers, and contractors immediately upon separation.

9. Handling Requirements

Handle all classified information appropriately throughout its entire lifecycle.
Collection
Only collect information necessary for lawful purposes.
Storage
Store information using appropriate safeguards.
Examples include:
* Secure cloud services
* Password protection
* Locked cabinets
* Encryption where appropriate
* Secure backup
Transmission

Transmit confidential information using secure methods.

Examples include:
* Encrypted email where available
* Secure file-sharing platforms
* Password-protected documents
* Secure cloud collaboration tools

Sensitive information shall not be transmitted through unsecured public channels.

Printing
Printed confidential information should:
* Be collected immediately.
* Not be left unattended.
* Be stored securely.
* Be shredded when no longer needed.

Mobile Devices

Accessing organizational information through laptops, phones, or tablets requires:

* Device passwords
* Screen locks
* Updated software
* Secure storage
* Prompt reporting of lost or stolen devices

Portable Storage
Minimize the use of USB drives and other removable media.
Where necessary:
* Encrypt sensitive information where feasible.
* Protect devices physically.
* Remove data promptly after use.

10. Email Handling

Users shall:
* Verify recipients before sending.
* Avoid sending unnecessary personal information.
* Protect attachments containing confidential information.
* Notify suspicious emails immediately.

11. Cloud Services

Cloud platforms shall:
* Meet appropriate security standards.
* Restrict access.
* Use secure authentication.
* Maintain backups.
* Protect personal information.

Only approved cloud services may be used for organizational data.

12. Third-Party Sharing

Information shall only be shared externally when:
* Authorized.
* Legally permitted.
* Contractually required.
* Necessary for program delivery.

Third parties shall maintain appropriate confidentiality and security safeguards.

Establish data-sharing agreements where appropriate.

13. Children’s Information

Information relating to children requires enhanced protection.

Special safeguards include:
* Restricted access.
* Parent or guardian consent where required.
* Secure storage.
* Confidential handling.
* Limited publication.
* Additional review before disclosure.

Child safeguarding considerations always take priority.

14. Incident Reporting

Report suspected information security incidents immediately.

Examples include:
* Lost devices
* Unauthorized disclosure
* Phishing
* Data breaches
* Accidental sharing
* Unauthorized access
* Malware infections

Prompt reporting allows timely investigation and mitigation.

15. Data Retention

Information shall be kept only for as long as necessary to:
* Deliver programs.
* Meet legal obligations.
* Fulfill contractual requirements.
* Respond to audits.
* Conserve essential organizational records.

Retention shall follow the organization’s Data Retention & Disposal Policy.

16. Secure Disposal

When information is no longer required, destroy it securely.
Examples include:
Paper
* Cross-cut shredding
* Secure destruction services

Digital
* Secure deletion
* Cryptographic erasure where applicable
* Physical destruction of storage media when appropriate

17. Training

All personnel handling organizational information shall receive periodic training covering:
* Data classification
* Information security
* Privacy
* Child safeguarding
* Secure handling
* Cybersecurity awareness
* Incident reporting

18. Compliance

Compliance with this policy is mandatory.
Violations might result in:
* Corrective action
* Disciplinary measures
* Termination of employment or volunteer engagement
* Contract termination
* Legal action where applicable

19. Related Policies

This policy should be read together with:
* Data Protection Policy
* Privacy Statement
* Information Security Policy
* Cybersecurity Policy
* Data Retention & Disposal Policy
* Cookie Notice
* Photography & Media Consent Policy
* Child Safeguarding Policy
* Acceptable Use Policy
* Incident Response Policy

20. Policy Review

This policy shall be reviewed every two years or earlier if required due to:
* Changes in legislation
* New cybersecurity threats
* Organizational changes
* Technological developments
* Audit findings
* Lessons learned from security incidents

21. Contact Information

For questions regarding this policy or information classification practices, please contact:

LekhanKala.org
Kathmandu, Nepal
Email: info@lekhankala.org
Website: https://lekhankala.org

Our Commitment

LekhanKala.org is dedicated to protecting entrusted information through trusted data classification, secure handling, and a culture of accountability.

By applying recognized information governance principles, we safeguard personal data, educational records, child protection information, and organizational assets while supporting transparency, legal compliance, cybersecurity robustness, and stakeholder trust.