How should I classify and protect sensitive data?
- Classify data as public, internal, confidential or highly sensitive
- Map purpose, collection, access, retention, deletion, sharing and backup expiry
- Protect the high-risk sets — employee IDs, passports, payroll, supplier verification documents — with encryption in transit and at rest, KMS-managed keys and rotation, least-privilege access and audit logs
- Minimise and redact: never log passwords, keys, tokens, full ID documents or confidential payloads
- Review UAE and cross-border legal obligations with counsel — technical controls alone do not establish legal compliance
- Keep an inventory of vendors/sub-processors and a breach-response plan