MField MEA Data Classification Policy (DCP)

1. Purpose

The purpose of this Data Classification Policy is to ensure that all data collected, processed, and stored by MField MEA is adequately protected based on its sensitivity and value. This policy provides a framework for classifying data to ensure its confidentiality, integrity, and availability.

2. Scope

This policy applies to all employees, contractors, consultants, temporary staff, and other workers at MField MEA, including all personnel affiliated with third parties. It covers all data collected through public questionnaires, as well as other data processed or stored by the company at our headquarters.

3. Data Classification Levels

• 3.1 Public
  • Description: Data intended for public disclosure. Unauthorized disclosure of public data would not negatively impact the company.
  • Examples: Marketing materials, publicly available reports, press releases.
• 3.2 Internal Use Only
  • Description: Data intended for use within MField MEA. Unauthorized disclosure could cause minor damage to the company’s operations or reputation.
  • Examples: Internal memos, internal project documents, employee handbooks.
• 3.3 Confidential
  • Description: Data that could cause significant harm to the company if disclosed. Unauthorized access could lead to legal liability, financial loss, or damage to the company’s reputation.
  • Examples: Employee records, customer data, financial reports, proprietary research data.
• 3.4 Restricted
  • Description: Highly sensitive data that requires the highest level of protection. Unauthorized access could result in severe damage to the company’s operations, legal standing, or reputation.
  • Examples: Personally identifiable information (PII), confidential business strategies, trade secrets, sensitive contractual agreements.

4. Roles and Responsibilities

• 4.1 Data Owners: Identify and classify data according to its sensitivity and value. Ensure appropriate protection measures are implemented for each classification level. Review and update data classifications periodically.
• 4.2 Data Custodians: Implement and manage security controls to protect data as per its classification. Ensure that data handling procedures comply with this policy.
• 4.3 Employees: Adhere to data handling procedures and security measures for data based on its classification. Report any data breaches or incidents to the IT Manager.
• 4.4 IT Manager: Develop and maintain the Data Classification Policy. Conduct regular audits to ensure compliance with the policy. Provide training and awareness programs on data classification.

5. Data Handling Procedures

• 5.1 Data Storage
  • Public: Can be stored on publicly accessible servers.
  • Internal Use Only: Store on internal servers with appropriate access controls.
  • Confidential: Store on secure servers with encryption and strict access controls.
  • Restricted: Store on highly secure servers with encryption, multi-factor authentication, and access logs.
• 5.2 Data Access
  • Public: Accessible by anyone.
  • Internal Use Only: Access restricted to internal personnel.
  • Confidential: Access limited to authorized personnel only.
  • Restricted: Access strictly controlled and limited to essential personnel only.
• 5.3 Data Disposal
  • Public: Can be discarded in regular waste.
  • Internal Use Only: Shred physical documents; delete electronic data securely.
  • Confidential: Shred physical documents; use secure deletion methods for electronic data.
  • Restricted: Use secure disposal methods, including shredding and data wiping, with documentation of disposal.

6. Training and Awareness

Conduct regular training sessions on data classification and handling procedures. Provide employees with resources and guidelines on the importance of data protection.

7. Compliance and Monitoring

Conduct regular audits and assessments to ensure adherence to the Data Classification Policy. Implement monitoring systems to detect and respond to any breaches or non-compliance incidents.

8. Review and Update

Review the Data Classification Policy annually or whenever significant changes occur. Update the policy to reflect new threats, technological changes, and legal or regulatory requirements.

9. Legal and Regulatory Compliance

Ensure compliance with Moroccan data protection laws and regulations. Adhere to international standards and best practices for data protection where applicable.

10. Contact Information

For questions or concerns regarding this policy, please contact:

• IT Manager: Khalid Bentaja
• Email: [email protected]
• Phone: +212 661-247956