Internal data
Class 2
Access restriction
Internal data is normally restricted to employees and authorized individuals for work purposes only.
Data protection controls
Protection such as encryption is not required when internal data is stored or shared internally. However, protection is required when internal data is shared with third parties (e.g. via SFTP) or stored on third party systems (e.g. encrypted file storage on Azure).
Frequently asked questions
When storing internal data, avoid using external media (e.g. USB drives). If external media must be used for storage purposes, password protect the internal files. Use access controls to restrict information to selected individuals. Information can be stored in:
- Shared network drives
- Sharepoint (external, internal, restricted)
- Sharepoint (modern)
- OneDrive
Internal physical documents must be stored in a non-public area.
You can share/transfer internal information via email.
Mark all internal data as ‘internal’ in the header or footer of document.
Internal physical documents must not be left unattended in a public area.
Responsible managers can decide who can have access to internal data. If sharing externally, ensure a non-disclosure agreement (NDA) is in place. For assistance creating an NDA, contact Legal Services.
Internal information can be disposed in the recycling bin.
Internal information should be archived according to Records Management Guidelines or deleted from workstations or devices.