Data Handling Policy

Current version

v2 (Review pending)

Effective

—

Next review

—

Expires

—

AI summary

AI summary: Data Handling Policy v2 — covers privacy & data handling with updates to previous version. Recommended attestation cycle: annual.

Attestation coverage

0 / 0 (0%)

Assignment audiences

-

# Data Handling Policy

## 1. Purpose

Establishes how Northstar Logistics classifies, stores, transmits, and retains information assets including customer shipment data, employee PII, financial records, and operational telemetry.

## 2. Classification

Data is classified as: Restricted (customer PII, payment data, employee SSN/government IDs), Confidential (internal financials, vendor contracts, route optimization data), Internal (operational dashboards, team communications), Public (marketing collateral, press releases).

## 3. Storage requirements

Restricted data must be encrypted at rest using AES-256 or equivalent. Confidential data must be stored in approved systems (no local-only copies). Access is governed by least-privilege RBAC reviewed quarterly.

## 4. Reviewer chain (RESTRICTED CATEGORY)

This policy is in the **restricted** category. Publication requires approvals from both **Legal** and **Information Security** reviewers before executive approval. Attempts to publish with only one reviewer will be blocked.