Skip to main content

Document & Data Classification Guide Page (for Google Drive)

A framework for classifying documents by sensitivity, and applying it in Google Drive.

The three tiers

Tier What Examples Sharing
Low Public or public-ready Blog posts, marketing, published reports Anyone with the link is fine
Medium Internal, not secret Meeting notes, draft strategy, budgets pre-approval Named people or internal group only; no link sharing
High Confidential, regulated, or PII SSNs, financial/payroll data, health info, donor/client records, credentials, HR files Named individuals only, reviewed periodically; no link sharing

Quick test: Would it place someone at risk if it leaked? If so, it should be at least Medium. Does it contain PII, financial, health, or credential data? It shoul be High. Is it meant to be public? Make it Low.

Applying Tiers to Google Drive

Naming: tag files/folders so sensitivity is visible at a glance, e.g. [H] Donor Contact List.

Folders: separate top-level folders per tier (Public/, Internal/, Confidential/) rather than mixing tiers in one folder. Restrict access at the folder level for Confidential/.

Sharing settings:

Review: quarterly, check who still has access to Confidential/ files, flag any "anyone with the link" shares that should be tighter, and sort anything sitting untagged in a misc folder.

If overshared: fix the sharing setting immediately, move the file to the right folder, and flag it to whoever owns incident response if High-sensitivity data was exposed.