Document & Data Classification Guide Page (for Google Drive)
A framework for classifying documents by sensitivity, and applying it in Google Drive.
The three tiers
| Tier | What | Examples | Sharing |
|---|---|---|---|
| Low | Public or public-ready | Blog posts, marketing, published reports | Anyone with the link is fine |
| Medium | Internal, not secret | Meeting notes, draft strategy, budgets pre-approval | Named people or internal group only; no link sharing |
| High | Confidential, regulated, or PII | SSNs, financial/payroll data, health info, donor/client records, credentials, HR files | Named individuals only, reviewed periodically; no link sharing |
Quick test: Would it place someone at risk if it leaked? If so, it should be at least Medium. Does it contain PII, financial, health, or credential data? It shoul be High. Is it meant to be public? Make it Low.
Applying Tiers to Google Drive
Naming: tag files/folders so sensitivity is visible at a glance, e.g. [H] Donor Contact List.
Folders: separate top-level folders per tier (Public/, Internal/, Confidential/) rather than mixing tiers in one folder. Restrict access at the folder level for Confidential/.
Sharing settings:
| Tier | Link sharing | Editors |
|---|---|---|
| Low | On | Few editors, open viewing |
| Medium | Off | Named editors/viewers |
| High | Off, access reviewed regularly | Minimal editors; disable download/print/copy for viewers where possible |
Review: quarterly, check who still has access to Confidential/ files, flag any "anyone with the link" shares that should be tighter, and sort anything sitting untagged in a misc folder.