Data Classification Policy

Winrock’s data, information, and knowledge, including its intellectual property, other confidential information and information that others provide us (Winrock Information), is an important asset. Our funders, donors, employees, consultants, beneficiaries and volunteers expect, and some laws require, that we protect certain types of confidential Winrock Information, including personal information. 

This Data Classification Policy describes the several types or classifications of Winrock Information, and for each classification, the appropriate collection, storage, transfer, and destruction, including data handling and security protections, that must be used based on the sensitivity of the information. 

Individual obligations. All of Winrock’s workforce (each employee, Board member, volunteer, intern and fellow, partners, subcontractors, and consultant) is required to ensure that Winrock Information is appropriately handled and protected. Winrock’s workforce must comply with this policy and manage the Information based on the applicable classification.

Data Classifications

Winrock classifies Information into four types:

• Public: Information that is or has been made freely available outside of Winrock or is intended for public use. Examples: Information on winrock.org; marketing; social media campaigns
• Internal: Data that is not classified as Confidential or Highly Confidential, but is valuable to the organization; unauthorized disclosure would cause minimal damage and would not result in material financial loss or serious damage to the reputation. Examples: Employee name and contact information, Winrock Policies and Manuals, training materials, Winrock-wide All Staff emails
• Confidential: Sensitive information for which unauthorized use or disclosure could result in serious damage including negative financial outcomes, loss of trust, damage to our reputation, regulatory. penalties, civil complaints, or a strategic disadvantage for Winrock. Examples: Budgets, proposals, project data that is not shared publicly, contracts, audit reports.
• Highly Confidential: Highly sensitive information that Winrock has a legal or regulatory obligation to protect from unauthorized use or disclosure, or for which unauthorized use or disclosure could result in severe or catastrophic damage including financial impacts, loss of trust, damage to the reputation, regulatory penalties, civil or criminal complaints, or a significant strategic disadvantage. Examples:  Personal information such as name plus bank account or government identification number, employee medical or health information, beneficiary personal and confidential data, internal strategic analyses for new business, passwords.

These classifications apply to data, information, knowledge, or records in any form (written, electronic, or verbal) that Winrock creates, receives, manages or collects. 

Information Handling

The following table describes, at a high level, how information within the different classifications is handled to ensure the proper level of confidentiality and protection. Click here for the Data Classification Procedure with more detailed information regarding the categories, examples, transmission, storage, and other handling requirements. The Highly Confidential classification presents the most risk to Winrock and must be handled with utmost care.

Table of Contents